Release 0.13.0: cookie/privacy consent banner + policy pages (instrumentation prep)

Roadmap item #11. Ships the non-modal bottom-of-page cookie consent
banner, the default /privacy and /cookies policy pages, the
`cookie_consent` table + two §17 endpoints for server-side persistence,
the localStorage fallback for anonymous viewers, the /settings
"Privacy & cookies" tab for revisiting the choice, and the
`frontend/src/lib/consent.js` helper that roadmap item #13's analytics
SDK (v0.15.0) will gate against. No analytics SDK ships in this release
— the consent infrastructure goes in first so the gate is already in
place. Adds SPEC §14.5 / §14.6, lists two new endpoints in §17, names
the new table in §5, and surfaces four §19.2 candidates (content-repo
file vs env-var policy, GPC / DNT headers, i18n, item-#13 dependency).
Two new optional env vars (`VITE_PRIVACY_POLICY_URL`,
`VITE_COOKIES_POLICY_URL`) — defaults render the framework's stub
pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,107 @@ skip versions are the composition of each intervening adjacent
 release's steps in order — no A-to-B path is pre-computed beyond
 that.
 
+## 0.13.0 — 2026-05-28
+
+**Minor — schema migration required; new optional env vars.** This
+release ships the cookie / privacy consent surface (roadmap item #11,
+SPEC §14.5 / §14.6). Every viewer — authenticated and anonymous alike —
+now sees a non-modal bottom-of-page banner on first visit asking which
+categories of cookies they allow (essential / essential + analytics /
+essential + analytics + other). The choice persists in `localStorage`
+for anonymous viewers and in a new `cookie_consent` table for
+authenticated viewers, with server-side overriding local on sign-in.
+The framework also ships default `/privacy` and `/cookies` policy pages
+that deployments can layer their own policy URL on top of via two new
+optional env vars. No analytics SDK ships in this release — the
+consent infrastructure is wired so item #13 (v0.15.0) can read from
+`frontend/src/lib/consent.js` when the SDK lands.
+
+### Added
+
+- **Cookie consent banner** (`frontend/src/components/CookieConsentBanner.jsx`).
+  Non-modal, bottom of viewport. Three single-select choices with
+  inline descriptions. Visible until the user makes a choice; hides
+  thereafter. Reachable for revision via the settings surface.
+- **Consent helper** (`frontend/src/lib/consent.js`). Exports
+  `getConsent()`, `hasChosen()`, `onConsentChange(cb)`, `setConsent()`,
+  `hydrateFromServer()`, `clearLocal()`. Cross-tab sync via the
+  `storage` event. Item #13's analytics SDK reads consent here before
+  importing.
+- **Privacy and cookies policy pages**
+  (`frontend/src/pages/Privacy.jsx`, `frontend/src/pages/Cookies.jsx`).
+  Default minimal policies that describe the framework's stance and
+  list the cookies the framework sets. Deployments override via the
+  two new env vars below; the framework's stub always renders above
+  the link so the framework-level contract stays visible.
+- **"Privacy & cookies" tab** in `/settings/notifications` showing
+  the current consent choice, the recorded-at stamp, and a "Change"
+  button that re-opens the banner via a custom DOM event.
+- **`§17` endpoints** —
+  - `GET  /api/users/me/cookie-consent` — read the current consent
+    record.
+  - `PUT  /api/users/me/cookie-consent` — write a new consent record.
+    Upserts a single row per user, stamps `recorded_at` to now,
+    accepts `essential` for symmetry but always persists it as true.
+- **Schema migration** `013_cookie_consent.sql` — new
+  `cookie_consent` table keyed by `user_id`, three flags
+  (`essential`, `analytics`, `other_cookies`), and `recorded_at`.
+  (Renumbered from `012_*` during driver integration because v0.7.0
+  also added a `012_otc.sql` migration that landed in the integration
+  order before this one.)
+- **SPEC `§14.5` Cookie / privacy consent** — settles the banner
+  shape, the three-category single-select, the storage shape (local
+  for anon, server row for authenticated), the precedence rule on
+  sign-in, and the `consent.js` helper surface for downstream
+  callers including item #13.
+- **SPEC `§14.6` Privacy and cookies policy pages** — settles the
+  `/privacy` and `/cookies` routes, the framework's stub content, and
+  the `VITE_PRIVACY_POLICY_URL` / `VITE_COOKIES_POLICY_URL` override
+  shape.
+- **SPEC `§5`** — names the `cookie_consent` table in the canonical
+  app-tables list.
+- **SPEC `§17`** — lists the two new cookie-consent endpoints.
+- **SPEC `§19.2`** — surfaces four candidates: policy content via
+  content-repo file vs env var, GPC / DNT headers, multi-language
+  consent text, and the item #13 analytics-SDK gating dependency.
+
+### Changed
+
+- **`frontend/.env.example`** — documents the two new optional env
+  vars `VITE_PRIVACY_POLICY_URL` and `VITE_COOKIES_POLICY_URL`. Unset
+  is supported; defaults render the framework's stub.
+- **`backend/app/api_notifications.py`** — module docstring grew two
+  endpoint lines; the new endpoints sit alongside the existing
+  `/api/users/me/*` neighbors.
+- **`frontend/src/App.jsx`** — registers `/privacy` and `/cookies`
+  routes (anonymous-reachable), wires `<CookieConsentBanner>` into
+  the global chrome, and listens for a `rfc-app:cookie-consent-reopen`
+  custom event to re-open the banner from the settings surface.
+
+### Upgrade steps (from 0.7.0)
+
+- You **MUST** rebuild the frontend and restart the backend after
+  upgrading. `frontend/package.json#version` and `VERSION` both move
+  to `0.13.0` and the build embeds the new env-var contract.
+- You **MUST** apply schema migration `013_cookie_consent.sql`. The
+  migration creates a single new table keyed by `user_id` with three
+  flag columns and a `recorded_at` stamp. The framework runs
+  migrations automatically at process start; no manual step is
+  required beyond restarting the backend so the migration runner
+  picks the file up.
+- You **MAY** set `VITE_PRIVACY_POLICY_URL` to an http(s) URL that
+  points at your deployment's full privacy policy. The framework's
+  `/privacy` page renders its built-in stub above a link to the
+  configured URL. Unset is supported — the stub is sufficient for a
+  default-config deployment.
+- You **MAY** set `VITE_COOKIES_POLICY_URL` to an http(s) URL that
+  points at your deployment's full cookies policy. Same shape as the
+  privacy URL.
+- You **MAY** announce the new consent banner to your users. Existing
+  authenticated users will see the banner on their next visit
+  (because their `cookie_consent` row does not yet exist); their
+  current sessions remain valid.
+
 ## 0.7.0 — 2026-05-28
 
 **Minor — schema migration required; new auth path is additive.**
@@ -257,6 +358,7 @@ explicit:
    dependency changes; the operator's role is reduced to rebuild +
    restart.
 
+
 ## 0.5.0 — 2026-05-27
 
 **Minor — no operator action required.** This release wires the