Name the referral in the new-referral email

The email fired at signup, before the member picked a username, so it always
said "A new member." Fire it instead when the username is first set (onboarding
/api/my/profile, empty->set transition only) so the sponsor's email names them
(@username). Removed the signup/verify triggers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -462,7 +462,8 @@ const server = http.createServer(async (req, res) => {
       const ref = parseCookies(req)['iap.sponsor'] || ''; // first-touch attribution
       const r = await accounts.signup(b.email, b.password, ref);
       if (r.error) return json(res, 400, r);
-      notifyNewReferral(ref, r.account).catch(() => {});
+      // sponsor is notified once the new member picks a username (onboarding),
+      // so the email can name them — see /api/my/profile
       if (b.newsletter) sendy.subscribe(r.account.email, r.account.username || '').catch(() => {}); // pre-checked opt-in, silent
       const token = await auth.mintSession({ email: r.account.email });
       return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
@@ -508,7 +509,7 @@ const server = http.createServer(async (req, res) => {
       const ref = parseCookies(req)['iap.sponsor'] || '';
       const r = await accounts.ensure(e, ref); // first touch wins; existing accounts unchanged
       if (r.error) return json(res, 400, r);
-      if (r.created) { notifyNewReferral(ref, r.account).catch(() => {}); sendWelcome(e, ref).catch(() => {}); }
+      if (r.created) { sendWelcome(e, ref).catch(() => {}); } // sponsor notified at username set (/api/my/profile)
       if (r.created && b.newsletter) sendy.subscribe(r.account.email, r.account.username || '').catch(() => {}); // pre-checked opt-in, silent, new joins only
       let memberId = 0;
       if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (err) {} }
@@ -662,7 +663,15 @@ const server = http.createServer(async (req, res) => {
       const s = await auth.fromRequest(req);
       if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
       const b = await readBody(req);
+      const before = await accounts.byEmail(s.email);
       const r = await accounts.setUsername(s.email, b.username);
+      // First time a username is set (onboarding): now there's a real name to
+      // show, so notify the sponsor here rather than at signup (where it'd just
+      // say "a new member"). Fires once — only on the empty→set transition.
+      if (!r.error && before && !before.username && b.username) {
+        const acct = await accounts.byEmail(s.email);
+        notifyNewReferral(acct && acct.sponsorRef, acct).catch(() => {});
+      }
       return json(res, r.error ? 400 : 200, r);
     }
     // -- earn credits by viewing ads (attention-gated daily claim)