feat(analytics): activate GA4 (G-KQ1JRV3KN7) + GDPR privacy page + GSC support

Client provided the GA4 Measurement ID and approved the standard policy.

- Activate analytics: NEXT_PUBLIC_GA_ID set to the FLUX property
  G-KQ1JRV3KN7 in the env template, with the same value as the
  docker-compose build-arg fallback so it works out of the box on deploy.
  (GA Measurement IDs are public — they ship in page HTML — safe to commit.)
- New GDPR-compliant Privacy & Cookie Policy page at /[locale]/privacy
  (all 5 locales), linked from the consent banner. Includes a clearly
  marked template disclaimer for legal review and a TODO on the contact
  email. Added to sitemap.
- Consent banner now links via the locale-aware next-intl Link.
- Google Search Console: optional NEXT_PUBLIC_GSC_VERIFICATION env var
  emits the google-site-verification meta tag (Dockerfile arg +
  docker-compose wired). Empty by default.

Verified: build inlines G-KQ1JRV3KN7 into the client bundle; the 5
/privacy routes render; TypeScript clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

env

@@ -19,7 +19,12 @@ SESSION_SECRET="CHANGE_ME_openssl_rand_base64_48_min_32_chars"
 # Google Analytics 4 Measurement ID (format: G-XXXXXXXXXX).
 # Leave empty to disable analytics entirely — the site loads no Google
 # scripts and the consent banner stays hidden until this is set.
-NEXT_PUBLIC_GA_ID=""
+# This is a PUBLIC value (it ships in the page HTML), safe to commit.
+NEXT_PUBLIC_GA_ID="G-KQ1JRV3KN7"
+
+# Google Search Console verification token (the content="" value from the
+# HTML-tag verification method). Leave empty if you verify via DNS or GA.
+NEXT_PUBLIC_GSC_VERIFICATION=""
 
 # OPEN AI KEY
 OPENAI_API_KEY=sk-proj-dsdsdsds-kaDAHhZXPYsK6-4uw0UWJZ0YuLnQfVoEA