excludedIps / excludedPaths configured but never enforced at ingest

Severity: High · Where: collect.ts:107-118 config.tracking.excludedIps / excludedPaths are configurable but never applied in the collect path → excluded traffic is still counted. Fix: Filter by IP and URL path at ingest before any write.