Sponsor attribution: last touch (30-day cookie), locked at account creation; 'Joining under' line at the code step; chatbot answer

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/assets/join.js

@@ -28,6 +28,8 @@
     const r = await api('/api/auth/email/start', { email: $('jnEmail').value });
     $('jnCodeRow').hidden = false; $('jnVerify').hidden = false; $('jnSend').hidden = true; $('jnResend').hidden = false;
     if (r.devCode) $('jnCode').value = r.devCode;
+    // the last thing they see before the account is created: who they are joining under
+    if (sponsorName) { $('jnUnder').textContent = 'Joining under ' + sponsorName + '. Not who invited you? Open their invite link first, then come back for the code.'; $('jnUnder').hidden = false; }
     IAP.status(r.sent ? 'Code sent. Check your inbox (and spam, the first time).' : 'Dev mode: code filled in.', 'ok');
     $('jnCode').focus();
   });
@@ -45,9 +47,11 @@
   $('jnEmail').addEventListener('keydown', e => { if (e.key === 'Enter') ($('jnVerify').hidden ? $('jnSend') : $('jnVerify')).click(); });
   $('jnCode').addEventListener('keydown', e => { if (e.key === 'Enter') $('jnVerify').click(); });
 
-  // sponsor line
+  // sponsor line (the link opened most recently sets the sponsor; it locks at account creation)
+  let sponsorName = '';
   fetch('/api/sponsor').then(r => r.json()).then(sp => {
     if (sp && sp.invited && sp.name) {
+      sponsorName = sp.name;
       $('jnSponName').textContent = sp.name;
       if (sp.avatarUrl) { $('jnSponImg').src = sp.avatarUrl; $('jnSponImg').hidden = false; }
       $('jnSpon').hidden = false;