c5e2c30ff3
track.js: on join pages with a ctb1_ clickid, count 30s of VISIBLE time (1s ticks, pauses when tab hidden), then report engaged once per session. server.js: relay engaged ctb1_ clickids to the CTB backend per the spec contract (X-Offer-Secret header, any-200-is-done); light in-process dedupe. New volume config keys ctbOfferPostbackUrl + ctbOfferSecret (PATCH allowlist). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>