Merge S3 (a1): affiliate + partner plumbing

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/app.js

@@ -189,6 +189,9 @@ app.use('/api/content', contentRoutes);
 // the public surface; the Next.js admin route proxies through with
 // the key kept server-side.
 app.use('/api/internal', internalRoutes);
+// A1 S3 — partner attribution report. Internal-key gated (router-level
+// requireInternalAuth); no Next proxy on purpose — never browser-facing.
+app.use('/api/partners', require('./routes/partners'));
 
 // Session 10 — Sentry's Express error handler catches uncaught
 // errors from every route mounted above. Must come AFTER routes but