Release 0.13.0: cookie/privacy consent banner + policy pages (instrumentation prep)

Roadmap item #11. Ships the non-modal bottom-of-page cookie consent
banner, the default /privacy and /cookies policy pages, the
`cookie_consent` table + two §17 endpoints for server-side persistence,
the localStorage fallback for anonymous viewers, the /settings
"Privacy & cookies" tab for revisiting the choice, and the
`frontend/src/lib/consent.js` helper that roadmap item #13's analytics
SDK (v0.15.0) will gate against. No analytics SDK ships in this release
— the consent infrastructure goes in first so the gate is already in
place. Adds SPEC §14.5 / §14.6, lists two new endpoints in §17, names
the new table in §5, and surfaces four §19.2 candidates (content-repo
file vs env-var policy, GPC / DNT headers, i18n, item-#13 dependency).
Two new optional env vars (`VITE_PRIVACY_POLICY_URL`,
`VITE_COOKIES_POLICY_URL`) — defaults render the framework's stub
pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/App.jsx

@@ -14,6 +14,9 @@ import Philosophy from './components/Philosophy.jsx'
 import NotificationSettings from './components/NotificationSettings.jsx'
 import Admin from './components/Admin.jsx'
 import ToastHost, { showToast } from './components/ToastHost.jsx'
+import CookieConsentBanner from './components/CookieConsentBanner.jsx'
+import Privacy from './pages/Privacy.jsx'
+import Cookies from './pages/Cookies.jsx'
 import './App.css'
 
 export default function App() {
@@ -24,8 +27,19 @@ export default function App() {
   const [inboxOpen, setInboxOpen] = useState(false)
   const [unreadCount, setUnreadCount] = useState(0)
   const [inboxTick, setInboxTick] = useState(0)
+  // §14.5: a tick that, when bumped, asks <CookieConsentBanner> to
+  // re-open even if the user has already made a choice. The settings
+  // "Privacy & cookies" tab dispatches a `rfc-app:cookie-consent-reopen`
+  // event that bumps this.
+  const [consentReopenTick, setConsentReopenTick] = useState(0)
   const navigate = useNavigate()
 
+  useEffect(() => {
+    const handler = () => setConsentReopenTick(t => t + 1)
+    window.addEventListener('rfc-app:cookie-consent-reopen', handler)
+    return () => window.removeEventListener('rfc-app:cookie-consent-reopen', handler)
+  }, [])
+
   useEffect(() => {
     getMe()
       .then(setMe)
@@ -134,6 +148,10 @@ export default function App() {
           <Route path="/login" element={<Login />} />
           <Route path="/beta-pending" element={<BetaPending />} />
           <Route path="/philosophy" element={<PhilosophyWithSidebar viewer={viewer} />} />
+          {/* §14.5 / §14.6: cookie-consent companions to /philosophy.
+              Available to anonymous and authenticated viewers alike. */}
+          <Route path="/privacy" element={<PolicyShell><Privacy /></PolicyShell>} />
+          <Route path="/cookies" element={<PolicyShell><Cookies /></PolicyShell>} />
           {viewer && (
             <Route path="/settings/notifications" element={<NotificationSettingsWithSidebar viewer={viewer} />} />
           )}
@@ -174,10 +192,18 @@ export default function App() {
         <Inbox onClose={() => setInboxOpen(false)} lastChangeTick={inboxTick} />
       )}
       <ToastHost />
+      <CookieConsentBanner viewer={viewer} forceOpen={consentReopenTick} />
     </div>
   )
 }
 
+function PolicyShell({ children }) {
+  // §14.5 / §14.6 policy pages reuse the chrome-pane shape so they
+  // render full-width without the catalog rail. The components inside
+  // carry their own back affordance per Philosophy.jsx's pattern.
+  return <main className="chrome-pane">{children}</main>
+}
+
 function PhilosophyWithSidebar({ viewer }) {
   // The chrome surfaces (§14.2 philosophy, §15 settings, §6/§17 admin)
   // all use the full app body — no catalog left pane, no propose modal.