feat(server): URL清洗三轨制+共享测试向量（D08）

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/constants.py

@@ -1,3 +1,5 @@
+import re
+
 EVENT_NAMES = {"page_view", "page_stay", "sdk_loaded"}
 MAX_EVENTS_PER_BATCH = 50
 MAX_PROP_KEYS = 32
@@ -7,7 +9,14 @@ MAX_TITLE_LEN = 200
 CLOCK_SKEW_LATE_SEC = 120        # 超过即标 late
 CLOCK_SKEW_REJECT_SEC = 86400    # 超过即拒绝
 SENSITIVE_KEY_PATTERNS = ("password", "passwd", "token", "secret", "card", "verif", "otp", "idcard")
-URL_PARAM_DROP_PATTERNS = ("email", "phone", "mobile", "token", "key", "password", "verif")
+SANITIZE_RULE_VERSION = "v2"
+# 三轨制（spec §2.4，slug 安全线=32）：①参数名黑名单整键删；②归因白名单提取保留；
+# ③其余按值判别：纯数字≤10位或 slug≤32 保留，其余删。
+URL_PARAM_DROP_PATTERNS = ("email", "phone", "mobile", "tel", "name", "user",
+                           "token", "key", "password", "verif", "passwd", "idcard")
+ATTRIBUTION_PARAM_WHITELIST = {"gclid", "gbraid", "wbraid", "fbclid", "msclkid",
+                               "yclid", "gad_source", "gad_campaignid", "dclid"}
+_SAFE_VALUE = re.compile(r"^(?:\d{1,10}|[A-Za-z0-9][A-Za-z0-9._-]{0,30})$")  # slug≤32：32+连续字母数字视为token删
 SESSION_IDLE_MS = 30 * 60 * 1000
 BOT_UA_KEYWORDS = ("bot", "spider", "crawl", "slurp", "bingpreview", "headless", "lighthouse")
 EVENT_PROP_WHITELIST = {          # spec §9.1：未知字段拒绝。免费文本/任意属性不得入库