fix(track): alias event tracking to /api/pulse to avoid adblocker filters

docker/backend/src/server.ts

@@ -494,7 +494,7 @@ app.post('/api/open-explorer', async (req, reply) => {
 // a beacon from every page, so it must never be a way to probe who is signed in
 // — it answers 204 whatever happens and echoes nothing back.
 const allowTrack = limiter(300, 60_000);
-app.post('/api/events', async (req, reply) => {
+const handleEventTrack = async (req: Parameters<typeof app.post>[1] extends (req: infer R, ...args: any[]) => any ? R : any, reply: any) => {
   const b = bodyOf(req);
   const ip = clientIp(req);
   if (!b || !isEventKind(b.kind) || !allowTrack(ip || 'unknown')) return reply.status(204).send();
@@ -519,7 +519,9 @@ app.post('/api/events', async (req, reply) => {
     device: ua.device,
   });
   return reply.status(204).send();
-});
+};
+app.post('/api/events', handleEventTrack);
+app.post('/api/pulse', handleEventTrack);
 
 // The film strip's ratings. Public and unauthenticated for the same reason the
 // counter is: any visitor may score a frame once, and the vote is held against