Unique visitors: split bots vs humans

[alanpeixinho]

Request metrics already bucket bots (is_bot() → browser/os/device = bot).
Unique-visitor counters do not:

• dashboard_unique_visitors_total
• dashboard_unique_visitors_by_endpoint_total
• Add a coarse client_kind=bot|human (or equivalent) on those counters. Reuse is_bot(). Same de-dup (hash + daily salt). No raw IP/UA in labels.
• Update Grafana, PRIVACY.md, docs/monitoring.md, tests (where necessary).

[alanpeixinho]

Also, we need to check if bot category is correctly classifying all bot requests (expecially because some of them show as Unknown)

[tales-aparecida]

How certain are we that we can identify and distinguish bots from humans?

[alanpeixinho]

How certain are we that we can identify and distinguish bots from humans?

This would be just an heuristic (which we can try to improve with log analysis), but would certainly still be prone to error.
Right now, what we do is try to find to catch self-identifying crawlers (bot|crawler|spider|slurp|duckduckbot|bingpreview|facebookexternalhit).
One point is that, right now, we are not classifying kci-dev as a bot (perhaps we should include its own category to help distinguish?).