fix(adtracking): 收紧成交口径、点击去重与生产落地页白名单

成交 GMV 排除已关闭订单，避免未支付关单被计入；点击按访客 5 秒、IP 1 秒双重去重；生产禁止 localhost 落地页，失效短码改用 QueryEscape。

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/shared/utils/trackCode.ts

@@ -1,14 +1,21 @@
 const TRACK_CODE_KEY = 'hfb_track_code'
 const TRACK_CODE_TTL_MS = 30 * 24 * 60 * 60 * 1000 // 30 天有效
+const TRACK_CODE_PATTERN = /^[a-zA-Z0-9_-]{2,64}$/
 
 interface StoredTrackCode {
   code: string
   timestamp: number
 }
 
+function sanitizeTrackCode(code: string): string {
+  const cleanCode = code.trim()
+  if (!TRACK_CODE_PATTERN.test(cleanCode)) return ''
+  return cleanCode
+}
+
 export function saveTrackCode(code: string): void {
   if (!code) return
-  const cleanCode = code.trim()
+  const cleanCode = sanitizeTrackCode(code)
   if (!cleanCode) return
   try {
     const item: StoredTrackCode = {
@@ -31,7 +38,7 @@ export function getTrackCode(): string {
       localStorage.removeItem(TRACK_CODE_KEY)
       return ''
     }
-    return item.code
+    return sanitizeTrackCode(item.code)
   } catch {
     return ''
   }