feat(telemetry): exclude configured phones from usage telemetry

- TELEMETRY_EXCLUDE_PHONES resolves to player ids at runtime, cached 10m
- excluded players write no activities, client events, or vitals
- their client errors are still captured

src/utils/activities.test.ts

@@ -20,6 +20,11 @@ vi.mock("@/lib/logger", () => ({
   },
 }));
 
+vi.mock("@/lib/telemetry/exclusions.server", () => ({
+  isExcludedPlayerId: async (playerId?: string) => playerId === "excluded-player",
+  isExcludedPhone: () => false,
+}));
+
 import { recordDeniedServerFn, serverFnLoggingMiddleware } from "./activities";
 import { setRequestActor } from "@/lib/telemetry/request-context.server";
 import { redirect } from "@tanstack/react-router";
@@ -303,6 +308,20 @@ describe("serverFnLoggingMiddleware control flow and dedup", () => {
     expect(h.createActivity.mock.calls[0][0].error).toContain("FORBIDDEN");
   });
 
+  it("does not record activity for excluded players", async () => {
+    setRequest("http://localhost:3000/_serverFn/doThing");
+    setRequestActor(h.request as unknown as Request, { playerId: "excluded-player" });
+
+    await runMiddleware({
+      next: async () => successEnvelope,
+      data: undefined,
+      context: {},
+    });
+
+    await flushWrites();
+    expect(h.createActivity).not.toHaveBeenCalled();
+  });
+
   it("prefers the stashed request actor over middleware context", async () => {
     setRequest("http://localhost:3000/_serverFn/doThing");
     setRequestActor(h.request as unknown as Request, { playerId: "p9" });