tl;dr: After switching nameservers to Cloudflare to enable R2 bucket serving, the author discovered Cloudflare automatically injected a JavaScript analytics snippet into their otherwise JS-free static site. Disabling it required manually adding the site to the Analytics dashboard and turning the snippet off. The author argues such tracking features should be opt-in rather than opt-out.