feat: anonymous ticket tracking as standalone public page

- tracking: promoted to public route (before auth gate) with full single-ticket view
- backend: GET /tickets/tracking/:id validates cookie tracking_token, returns responses/attachments/transfers
- tracking.js: rewrite - token list + chat-flow detail (player/staff bubbles) + processing log + anon reply
- ticket-create: anon submit now lands on #/tracking instead of home
- home: tracking tab navigates to standalone page

public/js/pages/home.js

@@ -34,10 +34,10 @@ const HomePage = {
 
   mount(tab) {
     const t = tab || 'report';
+    if (t === 'tracking') { App.navigate('tracking'); return; } // 追踪独立公开页
     document.querySelectorAll('#home-content .tab-nav button').forEach(b => { b.onclick = () => App.navigate('home', b.dataset.tab); });
     const ct = document.getElementById('home-tab');
-    if (t === 'tracking') this.renderTracking(ct);
-    else TicketCreate.render(ct, { type: t, prefill: {}, backLink: null, hideTabs: true });
+    TicketCreate.render(ct, { type: t, prefill: {}, backLink: null, hideTabs: true });
   },
 
   renderTracking(ct) {