ucr: annual-renewal reminder campaign + order-alert campaign source

UCR (Unified Carrier Registration) is annual: opens Oct 1, due Dec 31, mandatory
for interstate carriers (op A, same ~628k pool as IFTA) -> recurring revenue.

- build_ucr_annual_campaign.py: 3-touch business-day cadence (30/12/4 bd before
  Dec 31, wider than IFTA since it's once a year), escalating tone, same-day
  coupon, 'I already did it' suppression. Reuses build_trucking_campaigns +
  IFTA business-day/token helpers (DRY). Per-year cycle reset.
- ucr_annual_reminder.html: deadline + fines/OOS risk + 'we figure out your fee
  tier' + coupon + filed link + CAN-SPAM. Source campaign 473.
- migration 096: ucr_reminded_at / ucr_touch_no / ucr_self_filed_at.
- ifta.ts: add GET /api/v1/ucr/filed (shares the HMAC token scheme).
- checkout.ts: order-placement Telegram now shows 'Source: campaign (code X)'
  when a discount code is present, so IFTA/UCR/CLIA conversions are visible.
  (Confirmed order-alert Telegram already fires from handlePaymentComplete for
  all compliance orders via both webhook + session paths.)

api/src/routes/checkout.ts

@@ -1735,11 +1735,18 @@ export async function handlePaymentComplete(
       const idLine = dotNumber ? `DOT#: ${dotNumber}\n`
         : frn ? `FRN: ${frn}\n`
         : "";
+      // Campaign-source hint: an order carrying the daily campaign coupon (or any
+      // discount code) almost certainly came from an email campaign. Surface it so
+      // you can see the IFTA/UCR/CLIA/cold-email pipelines actually converting.
+      const srcLine = order.discount_code
+        ? `Source: campaign (code ${order.discount_code})\n`
+        : "";
       const msg = `💰 NEW ORDER\n\n`
         + `Customer: ${customerName}\n`
         + `Email: ${customerEmail}\n`
         + idLine
         + serviceLine
+        + srcLine
         + subtotalLine
         + discountLine
         + surchargeLine