[clockdev]

Previously, campaign aliases were limited to 3–16 alphanumeric characters, preventing aliases such as qz and demo_offer-2026.

This change allows 1–50 ASCII letters, digits, hyphens, and underscores in campaign forms and public routes. Whitespace and control characters are rejected.

Static routes retain priority, and __health is now reserved. Existing reserved aliases remain editable. Six-character Base58 generation, internal UUIDs, and case-insensitive uniqueness are preserved. No database migration is required.

Validation:

• 230 unit tests passed.
• 483 integration tests passed.
• 9 architecture tests passed.
• 12 browser tests passed.
• 63 publish shell tests passed.
• Composer validation, full PHPStan analysis, and PHP syntax checks passed.
• Docker and Bun/Tailwind builds passed.
• Three GeoLookup tests were skipped because GeoLite2 databases were unavailable.