Record Signup Source

Record WHY this account was created — the ?src= tag the visitor arrived with (audit/OUTREACH.md). Write-once and time-boxed:

• the tag only lands while signup_source is NULL (conditional UPDATE, the same exactly-once shape as the lifecycle-email markers), and
• only within the attribution window after account creation, so an old account cannot be re-attributed by a later tagged visit.

Refusals are 200s with recorded: false — a rejected tag simply leaves the user UNKNOWN, and the frontend must not retry forever on an error.