[T3.5] Implement ReferralCTA.tsx (link + copy + share)

[realproject7]

Epic: #1229 · Spec: §7.6 · Type: CODE · Estimate: 0.5 day · Depends on: T2.5e

Visual reference

📐 Final v5 design: z-design/plotlink-airdrop-final.html — referral CTA card, copy button, share button

Scope

Build src/components/airdrop/ReferralCTA.tsx.

Display

• User's referral link: https://plotlink.xyz/?ref=CODE (CODE from /api/airdrop/referral-code)
• [Copy] button (clipboard)
• [Share to X] button (opens https://x.com/intent/post?text=...&url=...)
• Optionally: qualified referral count + multiplier impact preview

Behavior

• Show only in Mining state (T3.1 gates this)
• Copy confirmation toast on click
• Share text suggests the multiplier benefit

Auth (RE1 round-25 — corrected)

/api/airdrop/referral-code has two methods with different auth (Risk A mitigation #1246/#1247):

• GET (display) — UNAUTH, shape-preserving { code, is_farcaster_username }. Used by this component for displaying the user's existing referral code. NO SIWE signature needed.
• POST (create/upsert) — requires SIWE via siwe-verify.ts. Used only as fallback if activation somehow did not auto-create a code for this wallet.

// Primary path: unauth GET to display
const { data } = useSWR(`/api/airdrop/referral-code?address=${address}`);

// Fallback (rare): if GET returns 200 with { code: null }, prompt user to re-sign + POST
// (RE1 r26: current /referral-code returns 200 + null when no code exists, NOT 404)
if (data && data.code === null) {
  // request fresh SIWE signature + POST /api/airdrop/referral-code
}

In practice, activation flow (T3.2 ActivationFlow → confirm-x-handle endpoint) auto-creates the ref code on first activation per T2.5a spec, so the fallback path should rarely fire.

Acceptance

• Ref code fetched via unauth GET /api/airdrop/referral-code?address=X (preserves Risk A — no SIWE required for display)
• Copy works on desktop + mobile
• X share opens intent URL with prefilled text
• Visible only in Mining state
• Visual matches z-design/plotlink-airdrop-final.html
• Gracefully handles signature expiry IF fallback POST path triggers (rare; activation flow auto-creates code)

Dependencies

T2.5e (referral endpoint auth migration to siwe-verify) — without this, the endpoint's auth path is the wrong one