Apple MPP open-inflation suppression + bot-click fingerprinting

[jusso-dev]

Why

Apple Mail Privacy Protection prefetches pixels; security tools prefetch click URLs. Both inflate metrics and produce false clicked rows.

Scope

• Detect MPP via User-Agent + client-ip, Apple Privacy Relay ranges, on pixel hits → tag as open_unverified.
• For clicks: bot fingerprint, HEAD requests, headless UA, sub-200ms prefetch from sender IP → tag clicked_bot not clicked.
• Reporting view filters bots by default.

Acceptance

• Test with Apple Mail does not create a clicked event.
• Bot prefetches counted separately.