0cd9a3a068
The new UI's sign-up form sent the invite code under key `aff`, but the backend `Register` controller binds it to `User.AffCode` whose JSON tag is `aff_code` (see model/user.go). Result: every invited sign-up landed with `inviter_id = 0`, breaking the affiliate flow. Rename only the request payload field so it matches the backend contract. URL query parameter (`/sign-up?aff=...`), localStorage key and OAuth state continue to use `aff` and are unchanged. Closes #4945