Add paid-traffic tracking: clickid capture and BeMob conversion postback

- track.js stores ?clickid= (or ?cid=) for the session; rides through
  bridge -> start navigation alongside the existing source attribution.
- Join click (the conversion) sends the clickid; server fires a
  fire-and-forget S2S postback to the admin-configured BeMob postback
  URL (cid + txid=join-<clickid>, payout 0) and counts successes per
  source in analytics.
- New admin setting: BeMob postback URL (server-side only, not exposed
  in public config).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/track.js

@@ -12,6 +12,12 @@
     }catch(e){return '(direct)'}
   }
   window.ctbGetSource=getSource;
+  try{
+    const p2=new URLSearchParams(location.search);
+    const cid=p2.get('clickid')||p2.get('cid');
+    if(cid&&!sessionStorage.getItem('ctb.clickid'))sessionStorage.setItem('ctb.clickid',cid.slice(0,80));
+  }catch(e){}
+  window.ctbGetClickId=function(){try{return sessionStorage.getItem('ctb.clickid')||''}catch(e){return ''}};
   const path=location.pathname.replace(/\/$/,'')||'/';
   const page=path==='/'?'bridge':(path==='/start'?'start':(path==='/training'?'training':null));
   if(page)fetch('/api/public/track',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({event:page,source:getSource()})}).catch(()=>{});