Record Click

Count a visit that arrived through ?ref=CODE.

Unauthenticated by design — the visitor is a stranger, and the ping fires on arrival, long before anyone signs in (same posture as /affiliate/apply; the limiter keys anonymous callers by IP).

Counted server-side rather than read back out of PostHog because ad-blockers eat posthog-js, and a number that decides who gets paid has to survive an affiliate comparing it against their own platform stats.

Always 200 {"received": true}: an unknown or deactivated code is a no-op, and saying so would turn this into a code oracle.