Server-side equivalent of the ?mref=<handle> install path. Resolves the
affiliate handle within this app's affiliate program and creates an
attribution against the customer's current app installation. Use this when
a referrer code is collected after install (e.g. paste-at-checkout) and
you don't want to wait for the GA4 → BigQuery attribution pipeline.

Idempotent. If any active attribution already exists for this customer's
app installation, the existing attribution is returned (200) and no
further side effects fire — first write wins. Only when no attribution
exists does this create one (201), fire program rules, enqueue
commission calculation, and dispatch the affiliates/referral webhook.

Auth is app-scoped only (X-Mantle-App-Id + X-Mantle-App-Api-Key with the
customerId in the body). Customer-scoped tokens are rejected — this
endpoint is intended for server-to-server use.