feat(legal): phase 6 — the privacy policy and the terms

PLAN.md §9. Builds /privacy and /terms, links them from the footer on every page,
and generates the Play Data Safety notes from the same inventory the policy renders.

Four decisions taken by the org lead before either page was written, recorded in
§9 under "How phase 6 built the legal pages":

  D30  DNS-only records, so the reverse proxy on the host keeps the only access
       log. Described qualitatively — the retention belongs to the proxy, and a
       policy that quotes a number the deployment does not enforce is worse than
       one that does not.
  D31  Eighteen or older. Above the children's-consent threshold everywhere in the
       EEA, so consent works with no parental-consent machinery this form could not
       honestly operate. Four surfaces render it from src/data/legal.mjs, and every
       one says plainly that nothing verifies it.
  D32  No governing-law clause. Nothing of value is contracted for here.
  D33  PLAY_DATA_SAFETY.md is generated from src/data/collection.mjs and checked in
       CI, so the published policy and the answers given to Google cannot drift.

/privacy is three separately-scoped sections because "we" means three different
parties: this site (one form, no cookies, no third-party requests), the Android app
(we operate no server it talks to — the rows are what the DEVICE holds), and a
self-hosted deployment (the operator is the controller, not us). Every row names the
file it was read out of, because a policy is the document most likely to be written
from a template and least likely to be re-read against the software.

/terms governs only what we run: this site, the beta list, and the APK we publish.
The software is governed by its licence, and a community's deployment by that
community — a terms page claiming authority over every install of a GPL program is
the thing a generated template gets wrong.

Also here:
  - the age clause changed CONSENT_TEXT, so CONSENT_VERSION gained a suffix; rows
    written from now on carry the new sentence and older rows keep theirs
  - PLANNED_ROUTES is now empty — these were its last two entries, and its reverse
    check is what forced the deletion; the list stays for phases 7 and 8
  - test/legal.test.mjs asserts the structural promises no build check can see,
    including that every mapped Play row still answers "not collected, not shared"
  - --check normalises line endings: the repo has no .gitattributes and Windows
    checkouts are CRLF, so a byte comparison would fail for every Windows developer
    while passing in CI

Verified: npm run verify green end to end (tokens, brand, data safety, astro check,
36 tests, build, 214 links, 19 facts), both pages walked in a browser, and neither
overflows at 390px. One defect the checks could not see and a look could: the
retention line was being pushed to the foot of the tallest card in its row, opening
a void in the middle of the short ones.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -41,8 +41,9 @@ makes that would otherwise decay quietly.
 ```bash
 npm run check:tokens                              # no colour literal outside the token file
 npm run check:brand                               # the branding pipeline's two quiet failures
+npm run check:datasafety                          # the Play declaration still matches /privacy
 npm run check                                     # astro check
-npm test                                          # the beta signup's decision path
+npm test                                          # the beta signup's decision path, and the policy data
 npm run build && npm run check:links              # every internal link resolves (reads the build)
 GITEA_TOKEN=<token> npm run check:facts           # every version agrees with its authority
 npm run verify                                    # all of the above, in that order
@@ -151,6 +152,9 @@ committed so that CI never needs either.
 ```
 src/
   data/platform.json     Every externally-sourced fact. No version is written in prose.
+  data/collection.mjs    What is collected, in three scopes. /privacy renders it and the
+                         Play Data Safety notes are generated from it — one inventory.
+  data/legal.mjs         The values /terms, /privacy and the consent sentence must share.
   styles/tokens.css      THE token file — the only place a colour literal may appear.
   styles/global.css      The layout shell, built entirely from tokens.
   styles/starlight.css   Restates our tokens as Starlight's, so the docs cannot drift.
@@ -170,6 +174,8 @@ brand-default/           The stock brand, baked into the image and always comple
 scripts/                 The build-time checks, plus applyBrand (boot), brand:assets (manual)
                          and beta.mjs (the tester-list CLI).
 test/                    node --test. The logic the other checks cannot see.
+PLAY_DATA_SAFETY.md      GENERATED. The answers to Google Play's Data Safety form, from
+                         src/data/collection.mjs. Edit the data, run npm run play:datasafety.
 ```
 
 Two directories are bind mounts at runtime and are **not** in the repository: `brand/` overrides