Track Affiliate Click

Public, unauthenticated endpoint. Records a click against an affiliate's referral code. Entire affiliate program is gated behind a feature flag (`config.growth.affiliateProgramEnabled`) that defaults off in production until explicitly enabled — every route in this group, including this one, returns `503` while the flag is off.

curl -X POST "https://example.com/api/v1/affiliates/click" \  -H "Content-Type: application/json" \  -d '{    "code": "jane-doe1"  }'

{  "success": true,  "message": "string",  "data": {    "tracked": true  }}