Mark Promo Seen

Record that the referral promo was shown for this session.

Called once per session by the client, not once per mount — "shown twice" has to mean two sittings, and a per-render increment would burn both views on a single page navigation.

$inc scoped to the one field rather than user.save(): this fires on app load, concurrently with the provisioning and /auth/me writes that happen at exactly the same moment, and a whole-document replace loses whichever of them landed first. Clamped in the filter so a client that calls it in a loop cannot run the count away from the cap.