Capture Reddit rdt_cid on registration and forward in betaOnboard claims

[GregorShear]

Context

A Reddit ad campaign lands users on /register?rdt_cid=…. The click id must survive the OAuth redirect and ride the betaOnboard directive submission so the backend can report the conversion (estuary/flow#3467). Query params do not survive the Supabase OAuth roundtrip, so the id is stashed in localStorage.

Changes

• Add RDT_CID = 'rdt_cid' to GlobalSearchParams (src/hooks/searchParams/useGlobalSearchParams.ts).
• Read the param in src/hooks/login/useLoginStateHandler.ts (covers both /register and /login) and write it to localStorage with a capture timestamp: new LocalStorageKeys entry plus a hook modeled on src/hooks/useMarketplaceLocalStorage.ts.
• In src/directives/BetaOnboard.tsx, read the stash at submit time and pass it as an extra arg to submit_onboard. Skip it when the capture is older than 30 days. Clear the stash after jobStatusPoller reports success.
• Map the value as rdtCid in generateUserClaim (src/directives/shared.ts) and update OnboardClaim (src/directives/types.ts). Omit the key entirely when there is no stash — a rdtCid: null key also trips deny_unknown_fields on an older agent and changes the stored claims shape for organic signups.
• Attach the id to the existing fireGtmEvent('Register', …) and postHog.capture('Tenant:Create', …) payloads in BetaOnboard.tsx for attribution cross-checks.

Acceptance

• Landing on /register?rdt_cid=X, registering via OAuth, and submitting the tenant form produces user_claims containing rdtCid: "X".
• Registration without the param sends claims identical to today.
• The stash is cleared after a successful submission.

Blocked by

Backend PR 1 of estuary/flow#3467: Claims is deny_unknown_fields, so the agent must accept rdtCid before this deploys, or affected signups fail with invalidClaims.