Add first-party acquisition attribution

[suguanYang]

Summary

• add a first-party acquisition attribution module for landing-session capture, first-touch normalization, TTL/dedupe, and signup binding
• add protected session/bind API routes, dashboard-side persistence, providers, and the marketing_attribution_sessions Drizzle schema/migration
• route analytics through local adapters and add an opt-in OpenAI Ads conversion adapter for signup, lead, checkout, order, and subscription events
• install the OpenAI Ads Measurement Pixel when configured, and mirror browser conversions to a server Conversions API route using the same event_id for dedupe

Verification

• pnpm test
• pnpm type-check
• pnpm exec biome check README.md app/layout.tsx lib/env.ts lib/config.ts providers/config-provider.tsx providers/analytics-provider.tsx lib/analytics/core.ts lib/analytics/index.ts lib/analytics/adapters/openai-ads.ts lib/analytics/adapters/openai-ads.test.ts server/openai-ads-conversions.ts lib/server/openai-ads-conversions.test.ts lib/env.test.ts
• git diff --check
• Oracle/Tailscale smoke environment exercised landing capture and signup binding paths against the shared local smoke database

Screenshots or Recordings

• not applicable; this is tracking, database, and provider plumbing rather than a visual layout change

Deployment Notes

• run the new Drizzle migration before relying on acquisition capture or metrics joins
• requires dashboard and metrics to read the same physical Knowhere database for the funnel view
• set OPENAI_ADS_PIXEL_ID=JDvSf6KLL8Y3e8QJhCmFF3 to enable the browser Measurement Pixel
• set OPENAI_ADS_CONVERSIONS_API_KEY to enable server-side OpenAI Ads Conversions API delivery; without it, browser pixel events still send but server delivery returns disabled
• OpenAI Ads browser and server events intentionally reuse the same event id so OpenAI can dedupe matching conversions

Checklist

• Tests were added or updated when behavior changed
• Public docs, examples, or screenshots were updated when needed
• User-visible UI changes were checked on responsive layouts
• Auth, billing, and API proxy changes avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change