feat(sdk): accept optional appToken on /api/sdk/v1/install (#24)

Adds `appToken: z.string().optional()` to the install endpoint's request
schema. Self-hosted single-tenant deployments accept the field and
ignore it — no behavior change.

Cloud uses it (via an onSend hook in linkforty/cloud) to scope organic
install events to the right workspace, fixing the multi-tenant data
leak from the post-#75 regression where organic installs couldn't be
scoped to any org. Without this schema entry, Zod would strip the
field from the parsed body before Cloud's hook could read it.

The token itself is a public Stripe-style publishable key shipped in
SDK app bundles. It only identifies which org owns the install — it
cannot authenticate API actions or expose private data.

Companion to LinkForty/cloud#76 (filed alongside).

Author: onamfc

src/routes/sdk.ts

@@ -52,6 +52,11 @@ export async function sdkRoutes(fastify: FastifyInstance) {
       platformVersion: z.string().optional(),
       deviceId: z.string().optional(),
       attributionWindowHours: z.number().optional(),
+      // Public app token shipped in SDK app bundles to scope organic
+      // installs to the right org in multi-tenant deployments. Used by
+      // Cloud's onSend hook (see cloud-event-hook.ts). Self-hosted
+      // single-tenant deployments simply ignore it.
+      appToken: z.string().optional(),
     });
 
     const body = schema.parse(request.body);