v3.2.6-sr94.18: Campaign URL builder

UTM campaign parameters

Inspired by seler's upstream PR #997, implemented independently for this fork's current architecture.

• Campaign fields in personal creation, personal/admin inline editing and workspace create/edit forms.
• Apply/clear updates the destination before the existing save action; no remote preview service or background persistence.
• Optional UTM fields on the existing link and workspace APIs, with an explicit destination required even on PATCH.
• Shared browser/server URL normalization, Unicode encoding, duplicate replacement, explicit removal and bounded encoded URL length.
• No new database columns, migration, runtime dependency, secret or permission scope. Campaigns are canonical destination parameters, preserving existing history, transfer, backup and redirect paths.
• Automated API/authorization/regression coverage and desktop/mobile Playwright tests, including queued-disclosure draft loss and mobile wrapping regressions.
• Defense in depth for legacy link mutations: cookie-authenticated requests reject foreign/null origins and cross-site fetches, without breaking valid explicitly authenticated API clients.

See campaign semantics and recovery. Public short redirects remain public; WAF and Authentik SSO remain required for management. The original roadmap PR thedevs-network#1046 remains separate.

Acceptance

Deployed 2026-09-15 after release CI, full exact-wrapper regression, desktop/mobile tests and an off-host backup restore. Full public WAF regression and real Authentik-signed logout/replay passed. Original records and secrets remain unchanged. Clean post-release NAS restore and two health samples 65 seconds apart passed. Image scan: zero critical/high, three existing medium BusyBox matches with no listed fix.

Detailed evidence and limits, including image-only rollback and separate physical-browser acceptance, are recorded in the community review.