feat: add secure email click analytics (#113)

[katsar0v]

Summary

• Rewrite eligible campaign and one-time email links through recipient-specific, HMAC-signed redirect URLs.
• Record privacy-safe first/last click timestamps and repeat counts, infer an open when images were blocked, and expose unique clickers, total clicks, CTR, CTOR, clicked-recipient filtering, and per-link performance.
• Add schema version 1.8.0 with a separate click token and aggregate table, plus queue-clear/uninstall cleanup.
• Exclude unsubscribe/confirmation links, unsupported schemes, existing tracking resources, and data-mskd-no-track anchors.
• Disable both open and click tracking on messages carrying BCC so BCC activity cannot be attributed to the primary recipient.
• Add Bulgarian/German translations, documentation, and automated security/send-path coverage.

Why

Open pixels are an approximate engagement signal because clients can block, proxy, or prefetch remote images. Secure click tracking provides a stronger interaction signal and per-link reporting while avoiding IP, user-agent, device, location, and personalized destination storage.

Dependency

This is intentionally stacked on feature/issue-111-email-open-analytics / #112 because it extends that branch's token, open-inference, and queue analytics foundation. Retarget this PR to main after #112 merges.

Closes #113.

Validation

• vendor/bin/phpunit --configuration tests/phpunit.xml --testsuite Unit — 221 tests, 484 assertions
• vendor/bin/phpcs — pass
• PHPCompatibilityWP with testVersion 7.4- on changed production PHP files — pass
• msgfmt --check --check-format for Bulgarian and German catalogs — pass
• git diff --check HEAD^ HEAD — pass

Manual checks

• Send campaign, scheduled one-time, and immediate one-time emails containing trackable and excluded links.
• Verify valid clicks redirect, increment totals, preserve first click, update last click, and infer an open when no pixel was loaded.
• Verify queue overview, clicked filter, recipient details, CTR/CTOR, and per-link results.
• Verify modified signatures or destinations return an error without redirecting or changing analytics.
• Verify messages carrying BCC contain neither tracking links nor an open pixel.