fix: infer acquisition source from trusted referrers

[fly1d]

Summary

• infer DEV, Hashnode, and GitHub campaign labels from trusted referrer hostnames when profile links omit a query source
• keep explicit valid query sources authoritative and leave unknown referrers at product-page
• document the hostname-only attribution boundary and add desktop/mobile regression coverage

Verification

• npm run check
• npm run test:smoke (5 passed, 1 configured skip)
• npm run test:site (12 passed)
• npm run desktop:check
• node --check site/waitlist.js

OpenAI Codex assistance was used for implementation and verification; all behavior and claims were reviewed against the repository.

[fly1d]

Review complete. The source precedence and host matching are bounded: a valid query parameter wins, only DEV/Hashnode/GitHub hostnames produce fallback labels, unknown referrers retain product-page, and only the hostname is read. Regression coverage passes on desktop and mobile. No blocking findings.