Stop the invite being lost when a prospect clicks through the nav

Terry hit this: he shares /join/840, his prospect taps "Training" in the
nav, and by the time they reach /start the site has forgotten him and
offers the COMPANY rotation position — #148. His referral, handed to a
stranger, because the prospect read the training first.

The invite now outlives the page it landed on:

- Serving /join/<id> sets an rmc_ref cookie (30 days, Lax).
- /start reads it (or an explicit ?ref=) and shows the INVITER instead of
  the company rotation, routed by exactly the same rules the inviter's own
  page uses — direct placement if their position is set that way, else the
  next open spot in their leg. The two pages can no longer disagree.
- The Join button carries ?ref through to /join-now, which already knew how
  to place a ref correctly but was never being given one from here.
- /join-now also falls back to the cookie when it arrives with no ?ref.

The page now says whose team it is ("Invited by Member #840") rather than
an anonymous "current placement", and when the inviter is already
qualified it says plainly that the entry fills the next open spot in their
team.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

server.js

@@ -1786,7 +1786,16 @@ function serveMemberPage(req,res,file,kind,id){
   ].join('');
   html=html.replace(/<meta\s+(?:property="og:[^"]*"|name="twitter:[^"]*")[^>]*>/gi,'');
   html=html.replace(/(<head[^>]*>)/i,`$1${og}`);
-  res.writeHead(200,securityHeaders({'Content-Type':'text/html; charset=utf-8','Cache-Control':'no-cache'}));
+  const head={'Content-Type':'text/html; charset=utf-8','Cache-Control':'no-cache'};
+  // Remember who invited this visitor. Terry hit this on 2026-09-18: a prospect opens
+  // /join/840, taps "Training" in the nav, and by the time they reach /start the site has
+  // forgotten him and offers the COMPANY rotation position instead — his referral, handed
+  // to a stranger. The invite is the referral, so it has to outlive the one page it landed
+  // on. 30 days, Lax so it survives a normal click-through from anywhere.
+  if(kind==='join'&&/^\d{1,15}$/.test(String(id))){
+    head['Set-Cookie']='rmc_ref='+id+'; Path=/; Max-Age=2592000; SameSite=Lax'+(IS_PROD?'; Secure':'');
+  }
+  res.writeHead(200,securityHeaders(head));
   res.end(html);
 }
 const server=http.createServer(async(req,res)=>{