trackConversion
Report that the caller reached their first authenticated console session, and return the event id the browser twin must fire with.
@isAuthenticated ONLY, and that is not "no authorization": the authorization
IS the subject. The row is keyed on the caller's own token subject, which is
never accepted from input, so there is no other principal's resource to gate
against. Everything else the caller could influence — consent, _fbp,
_fbc, the client IP and the User-Agent — is read server-side.
Idempotent per (subject, event, provider): a second call returns ALREADY_RECORDED with the first call's id.
trackConversion(
input: TrackConversionInput!
): TrackConversionResponse!