Write-once first-touch signup attribution.

The email/password signup path stores signup_source directly on the INSERT (POST /v1/auth/signup), but the Google OAuth flow never sends a JSON body — so the portal calls this once after the first authenticated page load, forwarding whatever UTM/referrer it stashed in localStorage when the visitor first landed.

Guards:

• Only fills NULL columns — a later visit with different UTM tags can never overwrite the original acquisition channel.
• Values are trimmed and length-capped server-side.