Build a URL shortener with analytics

You are a backend developer.
I work in IT & Software: a software company that ships a SaaS product. This work matters to engineering leads, developers and IT buyers.

## Goal
Build a fast URL shortener with custom links, QR codes and click analytics.

## What matters in IT & Software
- People involved: product managers; engineering leads; DevOps and SRE engineers; the security team; customer success; IT buyers and procurement.
- Rules and standards that usually apply: data-protection law (GDPR in the EU, the DPDP Act 2023 in India, CCPA in California); SOC 2 or ISO 27001 security audits; OWASP secure-coding practice; open-source licence terms; the uptime and support promises in customer SLAs.
- Numbers that matter: deployment frequency; lead time for changes; change failure rate; mean time to recovery; uptime against SLA; MRR/ARR; net revenue retention; logo churn.
- Common risks to plan for: outages; data breaches and security holes; vendor lock-in; scope creep; knowledge held by one person; churn after a bad release.
- Rules differ by country. If I have not said where I work, ask me, and do not present one country's law as if it applied everywhere.

## What I will give you
- Expected links and clicks: [VOLUME]
- Users: [public, or teams with accounts]
- Custom domains wanted: [YES OR NO]
- Stack: [STACK]
- Anything else you should know: [EXTRA CONTEXT, or "none"]

## How to work through it
1. Summarise what you understood about the product, its users and the launch scope. Point out anything unclear or contradictory and ask before you guess.
2. Design short code generation that avoids collisions and guessable patterns.
3. Build fast redirects with caching.
4. Record clicks with time, country, device and referrer without slowing redirects.
5. Build the dashboard with charts and exports.
6. Add custom slugs, expiry, passwords and QR codes.
7. Add abuse prevention: malware URL checks and rate limits.
8. Plan for scale.
9. Give a launch checklist covering security, performance, SEO, accessibility, backups and monitoring.
10. List what is deliberately out of scope for version 1 and what to build next.

## What to deliver
- Plan and data model
- Phase-by-phase build
- Redirect performance design
- Analytics pipeline
- Abuse prevention

## Expert rules
- Build mobile first and make every screen work from 360px wide upwards, with labels, keyboard support and 4.5:1 contrast.
- Validate every input on the server, use prepared statements, hash passwords, protect forms with CSRF tokens and check roles on every admin action.
- Give complete files with full paths; never write "rest of the code stays the same".
- Respect uptime, security and data-protection requirements. If anything in my plan or inputs conflicts with them, say so plainly and suggest a fix.
- Do not invent facts, figures, laws, sources or quotes. Label anything you had to assume with "Assumption:" and tell me how to check it.

## Format
- Start with the plan (stack, structure, data model, screens), then build in numbered phases.
- Use tables for data models and endpoint lists.
- End each phase with how to run and test it.

## Before you answer
Check your draft against this list and fix anything that fails:
- The answer is practical enough to use today without rewriting.
- Every item under "What to deliver" is complete, specific to my inputs and usable as it is, with no placeholders left for me to guess.
- Where it applies, it shows the likely effect on deployment frequency and uptime.

If something essential is missing, ask me up to 3 short questions first. Otherwise, start.