Syndicate member campaigns to AdRevLinks as Tier 1 popup ads

Second delivery surface for member campaigns, and deliberately the opposite shape to the
Network Ad Space rail: that one is Tier 3 heavy, this one only has prices configured for
US, CA, GB, AU, NZ and UM, so its traffic is Tier 1 by construction.

The AdRevLinks database is not reachable from this server, so rather than opening a
database port to the internet there is a narrow authenticated endpoint on that box which
does the insert locally. Five actions, no general query surface: a leaked key can only
create or remove popup campaigns. The secret lives outside that server's webroot and is
compared in constant time; Apache there strips Authorization, so it travels as
X-Bridge-Key.

adrevlnks.js mirrors nas.js, with two rules carried over from this morning's billing bug:
- DELIVERY IS READ, NEVER DERIVED. status returns the rotator's own per-country counters.
  Nothing is computed from a figure a stop could overwrite, which is exactly what charged
  16 members for undelivered impressions on the NAS side.
- EVERY WRITE IS IDEMPOTENT. Each campaign carries ref "iap:<id>", so a retry after a
  timeout returns the existing campaign instead of booking a second one.

Capped on purpose. That server serves roughly 5,500 popup impressions a DAY in total,
shared by every active campaign, and its rotator favours whichever has delivered least. So
syndicating everything unchecked would starve what is already running, Marty's own ads
included. Hence a credit floor and a per-campaign view cap. Cost is not the reason: he owns
the platform and treats the placements as free. Finite shared inventory is the reason.

Hooked into create, pause/resume and the scheduled end sweep so both networks stay in step.
Inert unless ADREVLNKS_BRIDGE_URL and _KEY are set, and a bridge hiccup can never block a
campaign going live.

qa/adrevlnks-bridge.mjs (15 assertions) drives the REAL endpoint: under-floor campaigns
skipped, full credit value booked, Tier 1 targeting, retry returns the same campaign,
delivery read back, pause/resume mirrored, then deleted and confirmed gone. Creates only
paused campaigns so no live traffic is spent, and leaves nothing behind.

nas-served 8, fraud-allow 12, sponsor-note 5, chatbot-parse 35, qa/run.sh member 0 bugs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

qa/adrevlnks-bridge.mjs

@@ -0,0 +1,65 @@
+// AdRevLinks popup syndication, driven against the REAL bridge on adrev.link.
+//
+// Creates a paused test campaign, reads its delivery back, pauses/resumes it, proves a
+// retry cannot double-book, then deletes it. Nothing is left behind and nothing is ever
+// activated, so no live traffic is spent.
+//
+//   ADREVLNKS_BRIDGE_URL=... ADREVLNKS_BRIDGE_KEY=... node qa/adrevlnks-bridge.mjs
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const arl = require('../adrevlnks.js');
+
+const ok = [], bad = [];
+const t = (n, c, extra) => { (c ? ok : bad).push(n + (c || !extra ? '' : '  -> ' + extra)); };
+
+if (!arl.enabled()) { console.log('SKIP: ADREVLNKS_BRIDGE_URL / _KEY not set'); process.exit(0); }
+
+const ID = 999000 + Math.floor(Math.random() * 900);
+const camp = { id: ID, name: 'QA bridge campaign', targetUrl: 'https://instantadpay.com/',
+               budget: 12000, spent: 0, accrued: 0, type: 'banner' };
+
+// a campaign below the floor is skipped quietly rather than wasting a slot
+const small = await arl.push({ ...camp, id: ID + 1, budget: 200 }, { paused: true });
+t('a campaign under the credit floor is not syndicated', small === null, JSON.stringify(small));
+
+// the real push
+const r = await arl.push(camp, { paused: true });
+t('campaign syndicated', !!(r && r.campaign_id), JSON.stringify(r));
+t('it books the full credit value as views', r && r.views_booked === 12000, r && String(r.views_booked));
+t('targeted Tier 1, not worldwide', r && Array.isArray(r.countries) && r.countries.includes('US') && !r.countries.includes('all'),
+  r && JSON.stringify(r.countries));
+t('created paused, so no live traffic is spent by the test', r && r.status === 2, r && String(r.status));
+
+// idempotency: the guard that stops a retry double-booking someone's traffic
+const again = await arl.push(camp, { paused: true });
+t('a retry returns the SAME campaign, never a second', again && again.campaign_id === r.campaign_id && again.duplicate === true,
+  JSON.stringify(again));
+
+// delivery is read from the rotator, never derived
+const st = await arl.readServed(ID);
+t('delivery reads back from the server', !!(st && st.ok), JSON.stringify(st).slice(0, 120));
+t('ordered views match what was booked', st && st.ordered_views === 12000, st && String(st.ordered_views));
+t('served starts at zero and is a real counter', st && st.served_views === 0, st && String(st.served_views));
+t('per-country items came back', st && Array.isArray(st.items) && st.items.length >= 3, st && String((st.items || []).length));
+
+// pause / resume mirror
+await arl.resume(ID);
+let s2 = await arl.readServed(ID);
+t('resume activates it', s2 && s2.status === 1, s2 && String(s2.status));
+await arl.pause(ID);
+s2 = await arl.readServed(ID);
+t('pause deactivates it', s2 && s2.status === 2, s2 && String(s2.status));
+
+// cleanup must actually work, or tests litter production
+const del = await arl.remove(ID);
+t('the test campaign is deleted', !!(del && del.ok), JSON.stringify(del));
+const gone = await arl.readServed(ID);
+t('and it is really gone', gone === null, JSON.stringify(gone));
+
+// an unknown campaign reads as null rather than throwing
+const none = await arl.readServed(ID + 12345);
+t('an unknown campaign reads as null', none === null, JSON.stringify(none));
+
+console.log('PASS ' + ok.length);
+for (const b of bad) console.log('FAIL ' + b);
+process.exit(bad.length ? 1 : 0);