Release 0.13.0: cookie/privacy consent banner + policy pages (instrumentation prep)

Roadmap item #11. Ships the non-modal bottom-of-page cookie consent
banner, the default /privacy and /cookies policy pages, the
`cookie_consent` table + two §17 endpoints for server-side persistence,
the localStorage fallback for anonymous viewers, the /settings
"Privacy & cookies" tab for revisiting the choice, and the
`frontend/src/lib/consent.js` helper that roadmap item #13's analytics
SDK (v0.15.0) will gate against. No analytics SDK ships in this release
— the consent infrastructure goes in first so the gate is already in
place. Adds SPEC §14.5 / §14.6, lists two new endpoints in §17, names
the new table in §5, and surfaces four §19.2 candidates (content-repo
file vs env-var policy, GPC / DNT headers, i18n, item-#13 dependency).
Two new optional env vars (`VITE_PRIVACY_POLICY_URL`,
`VITE_COOKIES_POLICY_URL`) — defaults render the framework's stub
pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api.js

@@ -532,6 +532,23 @@ export async function setQuietHours({ start, end, timezone } = {}) {
   }))
 }
 
+// v0.13.0 / roadmap item #11: cookie consent (SPEC §14.5).
+export async function getCookieConsent() {
+  return jsonOrThrow(await fetch('/api/users/me/cookie-consent'))
+}
+
+export async function setCookieConsent({ analytics, other } = {}) {
+  return jsonOrThrow(await fetch('/api/users/me/cookie-consent', {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      essential: true,
+      analytics: !!analytics,
+      other: !!other,
+    }),
+  }))
+}
+
 export async function muteUser(userId) {
   return jsonOrThrow(await fetch(`/api/users/${userId}/notification-mute`, { method: 'POST' }))
 }