Persist standard first-touch UTM attribution

[jmgasper]

Summary

• persist all six standard UTM fields for 30-day first-touch attribution
• validate cookie JSON and bound values to the shared AWS analytics contract
• propagate the complete attribution set to signup URLs
• document ownership boundaries so host applications initialize the AWS SDK only once
• resolve existing Svelte type errors surfaced by the required repository check

Verification

• npm run lint was attempted but this repository has no lint script
• npm run check: 0 errors and 0 warnings
• npm run build
• legacy Heap, Sprig, Google Analytics, and tag-manager reference scan: clean

[jmgasper]

CI note: the Use Trivy check fails during job setup, before repository checkout or scanning, because origin/dev already pins aquasecurity/trivy-action@0.33.1 and GitHub reports that version cannot be resolved. The branch does not modify the workflow. CircleCI build-dev, check-types, both CodeQL jobs, and the AI review all passed.