Clarify script injection behavior and stabilize browser coverage.

[paulber33]

Expose explicit script prefix and exclusion reasons in rendered output, and harden Playwright scenarios to avoid state leakage from excluded IP settings across tests.

Summary

Closes #13

Clarifies script injection behavior by rendering explicit comments for active and inactive tracking states. The inactive output now includes the tracking rule that excluded the visitor, making the rendered page easier to inspect and debug.

<!-- Simple Analytics - 100% privacy-first analytics (official WordPress plugin) -->
<script src="https://scripts.simpleanalyticscdn.com/latest.js"></script>

<!-- Simple Analytics: Script not included because this visitor is excluded by tracking rule: Exclude User Role -->
<script src=".../resources/js/inactive.js"></script>

<!-- Simple Analytics: Script not included because this visitor is excluded by tracking rule: Exclude IP Address -->
<script src=".../resources/js/inactive.js"></script>

Also stabilizes browser coverage by isolating excluded IP settings between Playwright scenarios.

Security implications

• No security impact
• Has security impact - described as:

Testing

Covered by updated Playwright browser scenarios for active script rendering, excluded user roles, and excluded IP addresses.

Checklist

• Linked to an issue
• Tested
• Asked for a review