url-shortener: QR encodes short URL with src=qr; forward query on redirect

QrHandler uses shortUrlForQr; RedirectHandler merges query string onto origin.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/LinkRepository.php

@@ -10,6 +10,12 @@ final class LinkRepository {
         return self::publicBase() . '/' . $slug;
     }
 
+    /** URL encoded in QR PNGs — always tagged for analytics. */
+    public static function shortUrlForQr(string $slug): string {
+        $url = self::shortUrl($slug);
+        return str_contains($url, '?') ? $url . '&src=qr' : $url . '?src=qr';
+    }
+
     /** @return array<string,mixed>|null */
     public static function findActiveByBearerOrigin(int $bearerId, string $originHash): ?array {
         $pdo = Database::pdo();

src/QrHandler.php

@@ -18,7 +18,7 @@ final class QrHandler {
         }
 
         $size = max(128, min(512, $size));
-        $target = LinkRepository::shortUrl($slug);
+        $target = LinkRepository::shortUrlForQr($slug);
         $png = self::renderPng($target, $size);
         if ($png === null) {
             JsonResponse::error(503, 'INTERNAL', 'QR generation unavailable (install qrencode on BE)');

src/RedirectHandler.php

@@ -12,8 +12,14 @@ final class RedirectHandler {
         }
         LinkRepository::recordRedirect($slug);
         AuditLog::write('redirect', (int) $link['bearer_id'], $slug, '');
+        $dest = (string) $link['origin'];
+        $query = (string) ($_SERVER['QUERY_STRING'] ?? '');
+        if ($query !== '') {
+            $dest .= str_contains($dest, '?') ? '&' : '?';
+            $dest .= $query;
+        }
         http_response_code(302);
-        header('Location: ' . (string) $link['origin']);
+        header('Location: ' . $dest);
         exit;
     }