Can I vibecode Fathom Analytics?

Build me a privacy-first web analytics service to replace Fathom Analytics. Requirements:

- Node + Express + better-sqlite3, one small app I deploy on my VPS behind
  Caddy or nginx.
- The tracker: a single script tag under 2 KB that sends pageview beacons
  (path, referrer, screen width) with navigator.sendBeacon. No cookies.
- Count unique visitors without storing personal data: hash IP + user agent
  with a salt that rotates daily, then drop the raw values.
- Filter obvious bots against a user-agent blocklist before counting.
- Dashboard page: pageviews, uniques, top pages, top referrers over 7/30/365
  days, one Chart.js line chart plus tables. Protected by a single bearer
  token from .env, no user accounts.
- Retention: raw events kept 30 days, daily rollups kept forever, pruned by a
  nightly node-cron job.
- No cookies, no personal data at rest, no telemetry of its own.
- Out of scope: email reports, team seats, billing. One site, or a short site
  list in config.
- README: deploy steps, adding the script tag, and a plain note that this is
  polite analytics, not a legal compliance product.