downloads: track every door and surface them on /analytics

The analytics page could not answer "how many downloads, of which
product". Three of the four download doors recorded nothing: the tRPC
click proxy only left the generic request row, whose path is the raw URL
with the asset buried in `?batch=1&input={"asset_name":...}`, and the S3
file route that serves Sparkle updates and the Nook app logged nothing
at all. The one door that did log (the Nook redirect) kept a private copy
of the logVisit/enrich/flush sequence, under its own path.

All doors now go through trackDownload, which writes one row per event
under /api/downloads/<asset> and flushes it inside the request — a click
is low-volume and serverless is not guaranteed to run the 30s batch
timer after the response. The file route maps its prefix allowlist to
asset keys, so a version bump stays one asset rather than one per
release. getAnalyticsSummary groups those rows into a downloads block and
the freno.me panel renders it under the overview cards.

History is recovered to the degree it exists: the Nook door's rows and
the tRPC clicks still carry enough to derive from (asset name in the URL).
scripts/backfill-downloads.ts inserts those derived rows with a
`backfill-<source id>` primary key and INSERT OR IGNORE, leaving the
originals untouched, so re-running is a no-op. Run against the live table
it added 66 rows: gaze 42, thenook 19, inputhalo 4, lineage 1.

Tests: new backfill suite (derivation, visitor detail carried over,
idempotency, empty history) and summariseDownloads cases; the Nook route
test now pins the canonical path, and the NOOK-337 allowlist audit reads
the map keys instead of quoted strings. Red-checked by stubbing the
downloads block back to zeros — the summary case fails, then passes.
Full suite matches master.

Co-Authored-By: nw-flash <noreply@nw-flash.local>
MISC-48

src/routes/api/the-nook/download.ts

@@ -1,7 +1,5 @@
 import type { APIEvent } from "@solidjs/start/server";
-import { getRequestIP } from "vinxi/http";
-import { logVisit, enrichAnalyticsEntry, flushAnalytics } from "~/server/analytics";
-import { parseUtm } from "~/server/utm";
+import { trackDownload } from "~/server/track-download";
 import { resolveLatestDownload } from "./_download";
 
 /**
@@ -15,13 +13,11 @@ import { resolveLatestDownload } from "./_download";
  * Why a redirect and not a direct S3 link: the appcast route and the DMG
  * route never logged anything, so step 2 of the funnel (download click →
  * DMG served) was invisible. Every click now lands one row in
- * VisitorAnalytics under the path below, which is what `topApiCalls`
- * already surfaces.
+ * VisitorAnalytics under `/api/downloads/thenook`, alongside the clicks and
+ * served files of every other product — see `~/server/track-download`.
  *
- * Country is read from the edge headers Vercel/Cloudflare set; the
- * analytics buffer carries a `country` column that nothing populated
- * until now. `?c=` is accepted as an override for previews and manual
- * verification.
+ * Referrer, campaign tags, edge country (with `?c=` override) and user agent
+ * are read by `trackDownload`, which is shared with the other download doors.
  *
  * ONLY the handler is exported here: Vinxi's route tree-shake deletes
  * exported declarations that are not in the router's `pick=` list, so a
@@ -29,47 +25,10 @@ import { resolveLatestDownload } from "./_download";
  * referenced it. All resolution helpers live in `./_download.ts`.
  */
 
-function firstHeader(request: Request, ...names: string[]): string | null {
-  for (const name of names) {
-    const value = request.headers.get(name);
-    if (value) return value;
-  }
-  return null;
-}
-
 export async function GET(event: APIEvent): Promise<Response> {
-  const { request } = event;
-  const url = new URL(request.url);
-
-  const forwarded = firstHeader(request, "x-forwarded-for");
-  const ipAddress =
-    getRequestIP(event.nativeEvent) ??
-    (forwarded ? forwarded.split(",")[0]!.trim() : null);
-
-  // Best-effort: a failed analytics write must never block a download.
-  // Flushed (not merely buffered) because a download click is low-volume and
-  // the batch timer is not guaranteed to survive the response on serverless.
-  try {
-    const referrer = firstHeader(request, "referer", "referrer");
-    await logVisit(
-      enrichAnalyticsEntry({
-        path: "/api/the-nook/download",
-        method: "GET",
-        referrer,
-        userAgent: firstHeader(request, "user-agent"),
-        ipAddress,
-        // The click carries its own tags when a campaign links straight here;
-        // otherwise the landing page's tags ride along in the referer.
-        ...parseUtm(request.url, referrer),
-        country:
-          url.searchParams.get("c") ??
-          firstHeader(request, "x-vercel-ip-country", "cf-ipcountry")
-      })
-    );
-    await flushAnalytics();
-  } catch (error) {
-    console.error("Failed to log download click:", error);
-  }
+  // Recorded before resolving: a click that dies at resolution is exactly the
+  // failure the funnel needs to show.
+  await trackDownload(event, "thenook");
 
   let target: string | null = null;
   try {