feat: hostdoc insight <code> — CloudFront visit stats (#43, cloudfront slice)

README.md

@@ -79,6 +79,28 @@ non-interactively.
 Overwriting (`--force`) and `hostdoc rm` automatically invalidate
 `/<code>/*` on the distribution.
 
+### Visit stats — `hostdoc insight <code>` (cloudfront)
+
+```bash
+hostdoc insight team/q1/report          # all available logs (~30 days)
+hostdoc insight team/q1/report --days 7 # last 7 days only
+hostdoc insight team/q1/report --since 2026-01-15   # logs on or after a date
+```
+
+Shows page-view hits and an approximate unique-visitor count (by client IP)
+for a published document, read from the CloudFront access logs in **your own**
+S3 bucket.
+
+**Enabling:** access logging is set up by `hostdoc provision`. If you provisioned
+before this feature, re-run `hostdoc provision` and then
+`hostdoc init --from-terraform <dir>` to add a log bucket. Only traffic after
+enabling is recorded, and CloudFront logs lag minutes to hours (not real-time).
+
+**Privacy:** logs are stored only in your S3 log bucket and contain visitor IP
+addresses. hostdoc uses IPs solely to approximate unique visitors and never
+sends them anywhere. Only a minimal field set is logged, and logs auto-expire
+after 30 days (`log_retention_days`).
+
 ### External (non-Route53) DNS
 
 Automated ACM validation and alias records require a Route53 hosted zone. If