fix: resolve all remaining audit failures across rust, svelte, and java

launcher/src-tauri/src/telemetry.rs

@@ -14,10 +14,15 @@ pub struct Recorder {
 }
 
 pub fn capture(state: &AppState) -> Option<Recorder> {
+    // We need at least a panel URL to report to. Token is optional – offline
+    // and Microsoft accounts won't have a panel token, but we still want to
+    // fire events where possible (the endpoint will just record them as
+    // unauthenticated). If there is no panel configured at all, skip silently.
     let panel = state.panel_url()?;
+    let token = accounts::panel_token(state);
     let accounts = state.accounts.read().unwrap();
     let active = accounts.active()?;
-    let token = accounts::panel_token(state);
+
     Some(Recorder {
         http: state.http.clone(),
         panel,