Fraud Tag Setup

Sets up click-fraud (invalid traffic) tracking. Google never reveals which IP clicked an ad, so detection is only possible with a one-line tag on the landing pages; this tool returns that tag plus the unique site key. `domain` (the website domain) binds the tag to that domain so nobody can inject fake clicks into the data. FOR A SITE HOSTED ON OPUS GROWTH: install=true writes the tag into every page of the site automatically (idempotent, safe to re-run); the response reports how many pages were updated. Otherwise the snippet goes into the <head> of every page, or create_gtm_tag adds it; the snippet carries the site key IN THE URL, so it works unchanged in a GTM Custom HTML tag (GTM drops custom data-attributes, so a rewritten attribute form would collect nothing). The response always reports `status`: how many ad clicks were captured in the last 24h/7d, which shows whether the install works. Data is only collected on visits that arrive FROM an ad (the landing URL must carry gclid/gbraid/wbraid), so organic visits never appear. After a few days of traffic: fraud_scan shows the suspicious IPs, block_ip_addresses excludes them from the campaigns. An edge/CDN firewall rule is NOT an alternative — it cannot refund a click Google already charged for.