Filter first-party domains from tracker mapping

Tracker scripts loaded through a first-party reverse proxy (e.g.
t.probo.com proxying PostHog) share the scanned site's eTLD+1 and
were incorrectly matched against the site owner's own
CommonThirdParty entry in matchByDomain. This caused trackers like
ph_phc_* to be attributed to the site owner instead of PostHog.

Load the CookieBanner origin in Process and pass it to both
matchByDomain and identifyWithAgent. Both now filter out initiator
domains whose eTLD+1 matches the site before querying the catalog
or feeding domains to the LLM agent. The prompt is also updated to
warn about proxy domains.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/uri/uri.go

@@ -102,3 +102,26 @@ func ExtractDomain(rawURL string) string {
 
 	return domain
 }
+
+// FilterFirstPartyDomains removes domains that match the eTLD+1 of
+// siteOrigin. Tracker scripts loaded through a first-party proxy (e.g.
+// t.probo.com proxying PostHog on a probo.com site) share the site's
+// eTLD+1 and carry no signal about the actual third party. siteOrigin
+// is a full URL such as "https://app.probo.com". The input domains are
+// expected to be eTLD+1 strings (as produced by ExtractDomain).
+func FilterFirstPartyDomains(domains []string, siteOrigin string) []string {
+	siteDomain := ExtractDomain(siteOrigin)
+	if siteDomain == "" {
+		return domains
+	}
+
+	filtered := make([]string, 0, len(domains))
+
+	for _, d := range domains {
+		if d != siteDomain {
+			filtered = append(filtered, d)
+		}
+	}
+
+	return filtered
+}