fix(adtracking): 收紧成交口径、点击去重与生产落地页白名单

成交 GMV 排除已关闭订单，避免未支付关单被计入；点击按访客 5 秒、IP 1 秒双重去重；生产禁止 localhost 落地页，失效短码改用 QueryEscape。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/internal/modules/adtracking/handler.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 
@@ -25,7 +26,7 @@ func NewHandler(service *Service) *Handler {
 // Redirect 公开短链 302 智能重定向
 func (h *Handler) Redirect(c *gin.Context) {
 	code := strings.TrimSpace(c.Param("code"))
-	if code == "" {
+	if !codePattern.MatchString(code) {
 		c.Redirect(http.StatusFound, "https://hao858.com/")
 		return
 	}
@@ -45,7 +46,7 @@ func (h *Handler) Redirect(c *gin.Context) {
 	targetURL, err := h.service.ResolveRedirect(c.Request.Context(), code, ip, ua, referer, visitorID)
 	if err != nil {
 		// 链接不存在或已停用时，优雅兜底跳转至官网首页，附带失效短码参数以备提示
-		c.Redirect(http.StatusFound, "https://hao858.com/?ref_invalid="+urlEscape(code))
+		c.Redirect(http.StatusFound, "https://hao858.com/?ref_invalid="+url.QueryEscape(code))
 		return
 	}
 
@@ -171,10 +172,6 @@ func generateVisitorID() string {
 	return hex.EncodeToString(b)
 }
 
-func urlEscape(s string) string {
-	return strings.ReplaceAll(s, " ", "%20")
-}
-
 func getRequestBaseURL(c *gin.Context) string {
 	scheme := "https"
 	if proto := c.Request.Header.Get("X-Forwarded-Proto"); proto != "" {