feat(server): URL清洗三轨制+共享测试向量（D08）

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/tests/test_validation.py

@@ -1,7 +1,12 @@
+import json
+import pathlib
 from datetime import datetime, timedelta
 from django.utils import timezone
+from tracker import constants as C
 from tracker.services.validation import validate_event, sanitize_url
 
+VECTORS = json.loads((pathlib.Path(__file__).parent / "fixtures" / "sanitize_vectors.json").read_text(encoding="utf-8"))
+
 NOW = timezone.now()
 
 def _ev(**kw):
@@ -46,11 +51,12 @@ def test_pageview_referrer_url_sanitized():
 
 
 def test_pageview_referrer_truncated_after_reencode():
-    """清洗重编码（中文 → %XX 九倍膨胀）可能超出原长：出门统一截 MAX_STR_LEN=500。"""
-    ev = _ev(properties={"referrer": "https://www.bing.com/search?q=" + "词" * 200})
-    assert validate_event(ev) is None              # 原文 227 字符过长度门
+    """清洗重编码（中文 → %XX 九倍膨胀）可能超出原长：出门统一截 MAX_STR_LEN=500。
+    用 utm 值驱动：utm 参数三轨制下无条件保留（不走值判别），膨胀路径仍可达。"""
+    ev = _ev(properties={"referrer": "https://www.bing.com/search?utm_term=" + "词" * 200})
+    assert validate_event(ev) is None              # 原文 237 字符过长度门
     ref = ev["properties"]["referrer"]
-    assert len(ref) == 500 and ref.startswith("https://www.bing.com/search?q=%E8%AF%8D")
+    assert len(ref) == 500 and ref.startswith("https://www.bing.com/search?utm_term=%E8%AF%8D")
 
 def test_nested_sensitive_key_rejected():
     assert validate_event(_ev(properties={"utm": {"utm_a": 1, "user_password": "x"}})) == "sensitive_field"  # utm 在白名单内，嵌套敏感键仍须命中
@@ -83,3 +89,10 @@ def test_non_str_path_rejected():
 
 def test_prop_depth_exceeded():
     assert validate_event(_ev(properties={"utm": {"a": {"b": 1}}})) == "properties_depth"
+
+def test_sanitize_url_vectors():
+    for v in VECTORS["vectors"]:
+        assert sanitize_url(v["in"]) == v["out"], v["in"]
+
+def test_sanitize_rule_version_exported():
+    assert C.SANITIZE_RULE_VERSION == VECTORS["rule_version"]