tracking

The Tracking submodule implements the two classic email-analytics mechanisms — open tracking and click tracking — through signed, single-purpose tokens stored in `campaign_tracking`. While building a message's HTML during send, CampaignEmailWorkerService calls `generateOpenToken` once per message and injects a 1×1 transparent GIF (`<img>` tag pointing at `/campaign/track/open/:token`) just before the closing `</body>` tag — or appended to the end of the HTML if no `</body>` is found. It separately scans every `<a href="...">` in the rendered HTML (skipping the unsubscribe link itself, anchor-only links, and `mailto:` links) and rewrites each target through `generateClickToken`, so every outbound link in a sent campaign email is individually trackable back to that exact message and recipient.

`GET /campaign/track/open/:token` is the pixel endpoint: it records the open (IP, user-agent, timestamp) only on the first hit — `tracked_at` being non-null is the idempotency guard against image-prefetching clients or repeated opens double-counting — then always returns the same inline 1×1 GIF with `Cache-Control: no-store` so mail clients never cache a stale pixel. On that first hit it also writes an `open` campaign event and increments the campaign's `total_opened` counter. `GET /campaign/track/click/:token` follows the same first-hit-only recording pattern for clicks (`total_clicked`, a `click` event with the original target URL in metadata) and then issues an HTTP redirect to the original `target_url` that was captured when the link was rewritten — falling back to `/` if the token is unknown, so a broken or expired tracking link never dead-ends the recipient.

Both recording paths are wrapped in their own try/catch with internal logging rather than throwing, since these endpoints are invoked by mail clients and browsers with no error-handling expectations — a tracking failure must never break the image render or the redirect.