chore: Django 工程骨架（config+tracker app+常量）

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/constants.py

@@ -0,0 +1,19 @@
+EVENT_NAMES = {"page_view", "page_stay", "sdk_loaded"}
+MAX_EVENTS_PER_BATCH = 50
+MAX_PROP_KEYS = 32
+MAX_STR_LEN = 500
+MAX_PATH_LEN = 500
+MAX_TITLE_LEN = 200
+CLOCK_SKEW_LATE_SEC = 120        # 超过即标 late
+CLOCK_SKEW_REJECT_SEC = 86400    # 超过即拒绝
+SENSITIVE_KEY_PATTERNS = ("password", "passwd", "token", "secret", "card", "verif", "otp", "idcard")
+URL_PARAM_DROP_PATTERNS = ("email", "phone", "mobile", "token", "key", "password", "verif")
+SESSION_IDLE_MS = 30 * 60 * 1000
+BOT_UA_KEYWORDS = ("bot", "spider", "crawl", "slurp", "bingpreview", "headless", "lighthouse")
+EVENT_PROP_WHITELIST = {          # spec §9.1：未知字段拒绝。免费文本/任意属性不得入库
+    "page_view": {"referrer", "referrer_domain", "utm"},
+    "page_stay": {"active_ms", "path"},
+    "sdk_loaded": {"sdk_version"},
+}
+MAX_PROP_DEPTH = 2
+MAX_PROP_JSON_BYTES = 4096