Track Capi Event

Accept a browser tracking event and forward it to Meta CAPI.

Intentionally public: mounted on public_router with no auth dependency. Every caller (app/power-ui/src/utils/metaPixel.ts, reached from Cookiebot consent, the marketing pages, and signup) fires before the user has a token, so requiring a Bearer would silently break conversion tracking.

Abuse controls, in place of auth:

• event_name is checked against ALLOWED_EVENT_NAMES
• @limiter.limit("30/minute") per client IP
• TrackingEventRequest caps every field's length and custom_data size
• email / phone are SHA-256 hashed before leaving this process
• nothing is persisted in power-api; the response echoes no input
• the only outbound sink is https://graph.facebook.com/v19.0/{pixel_id}/events, built from settings — event_source_url reaches the JSON body only

CMP consent is enforced by the caller, not here: hasMarketingConsent() in app/power-ui/src/utils/marketingConsent.ts gates sendCapiEvent, so a visitor who declined marketing never reaches this endpoint. A server-side check is not possible — the Cookiebot decision lives in the browser and any flag on this unauthenticated request would be client-asserted anyway (PRO-3255).

Ref: PLA-5052 (Shannon audit hash 05faedc8aeb9), reviewed 2026-07. The public posture is by design; do not "fix" it by adding an auth dependency.