Keep sign-up attribution through the sign-in redirect

[helpcodeai]

What was lost. The Install buttons on the guide and marketplace pages link to /connectors/store?install=<slug> with the visitor's attribution appended (amcp_src, amcp_lt, utm tags, Google Ads click ids). A signed-out visitor is sent to /login?redirect=<path+query> by the proxy, so all of it ended up inside redirect. The sign-up page only reads these at the top of its own URL, so those sign-ups were recorded as direct.

What changed.

• proxy.ts: when redirecting to /login, the attribution params move to the top of the login URL and are dropped from redirect (the store has no use for them, and keeping both would only put them in the address bar twice). Any other query, like install=weclapp or fbclid, stays in redirect as before. A query without attribution is passed through byte for byte.
• The list is a new LANDING_PARAM_KEYS in lib/attribution.ts, built from the keys that module already reads: amcp_src, amcp_lt, utm_source/medium/campaign/term/content, gad_source, gad_campaignid, gclid, gbraid, wbraid. fbclid and msclkid are not read anywhere, so they are left alone.
• Unchanged: redirect is still a relative path checked by safeRedirect on the login page, signed-in visitors still go straight through, and /login?mode=register&... links from the landing pages never pass through this redirect.

Tests. login-redirect-query.spec.ts now covers the lifted params and what stays in redirect, a path with only attribution, a signed-in request (no redirect), and a full run from an install link to the register request, checking that attribution carries the site's first and last touch. The three new redirect tests fail against the old proxy.