1.4.0: attribution cookie bridge + expanded source resolution

Brings the lead-source logic in line with cars4us-laravel and
mct-motorsport-brisbane so attribution survives cross-page navigation
and full-page caching (W3 Total Cache / WP Rocket / CloudFront).

class-form.php
 - get_tracking_data(): resolve source in priority order
   utm_source -> referrer-host mapping -> paid click-ID inference ->
   Organic. Previously only utm_source or 'Organic'.
 - New private helpers: first_scalar() (collapses bracketed-array query
   params like ?utm_source[0]=bing), infer_source_from_paid_click_ids()
   (gclid->google, msclkid->bing, fbclid->fb),
   detect_source_from_referrer() (host map for AI assistants, search
   engines, marketplaces, socials).
 - gclid / fbclid / msclkid now captured from both $_GET and the
   referrer query string, and passed through to the CRM.
 - route_create_lead() now forwards fbclid and msclkid (previously
   only gclid).
 - New wp_enqueue_scripts hook loads the attribution bridge on every
   page, not just pages rendering the shortcode.

assets/(src|dist)/js/attribution-cookies.js (new)
 - Plain ES5 vanilla JS, no build step required.
 - Captures utm_* / gclid / fbclid / msclkid from window.location.search
   (handles normal and bracketed-array shapes) into mct_* cookies for
   1 hour.
 - On form pages, syncs cookie values into the form's hidden inputs
   at DOMContentLoaded, overriding the PHP-baked values - which keeps
   attribution correct even when the HTML is served from a cache.

mct-lead-form.php
 - Version: 1.3.12 -> 1.4.0.
 - MCT_VERSION: 1.0 (float) -> '1.4.0' (string) so wp_enqueue_script
   cache-busting picks up the new release.

Made-with: Cursor