Move scripts server side

[ronakganatra]

No description provided.

[stefanoverna]

Hey — pushed a round of changes on top. Here's what's different now, no jargon:

LinkedIn conversion tracking now respects cookie consent
Before, we were sending the hashed email to LinkedIn on every sales/partner form submission, regardless of whether the visitor had accepted cookies. Now:

• Visitors outside Europe / GDPR countries → tracked (they never see the cookie banner, so they're auto-accepted, just like today).
• GDPR visitors who accepted the cookie banner → tracked.
• GDPR visitors who rejected or haven't answered yet → not tracked.

This matches what the front-end Insight Tag does, so the two channels behave consistently.

Form submissions are faster
LinkedIn and Front Channel calls now run in parallel with the Pipedrive flow instead of one-after-another. Should shave a few hundred ms off each form submit. No change to what gets sent.

One less double-count risk
The original code was sending a "transaction ID" with each LinkedIn event that included a timestamp — turns out that field is for de-duplicating between Insight Tag and Conversions API, not for guarding against the same user submitting twice. Dropped it (it's optional).

Three Google Ads / LinkedIn config items are now defined once
Previously the Google Ads account ID and the three conversion labels were copy-pasted across 4 files. They now live in one place (src/lib/googleAds.ts) so we can't drift.

Production secrets are wired
LINKEDIN_ACCESS_TOKEN is in AWS Secrets Manager (production only); LINKEDIN_PARTNER_ID is set as a build arg in cubo.json5. Staging won't try to fire the LinkedIn calls (vars are absent → it just skips, no errors).

No tracking lost on slow LinkedIn API
Added a 5-second timeout to the LinkedIn call so a hanging response doesn't hold up the user's form submit. If it times out, we log it but the form still succeeds.

Docs
Added a CLAUDE.md at the root explaining how env vars work in this repo (build-time vs runtime, public vs secret) so we don't keep re-learning it.