feat(web,legal): aggressive legal-compliance release for market launch #4104

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/27

Summary

Aggressive legal-compliance surface so AlecRae can ship to market with maximum regulatory cover across EU, UK, US (federal + California), Canada, Australia, Brazil, and Germany.

Cross-cutting infrastructure

• Typed consent library (apps/web/lib/consent.ts) — version-stamped records, default-deny for non-essential categories, GPC + DNT auto-respect, 11 regulatory-critical vitest tests (jsdom)
• ConsentBanner component — granular toggles, equal-weight Accept / Reject / Manage buttons (no dark patterns), listens for alecrae:open-consent event
• LegalFooter component with 17 legal links + cookie-preferences trigger
• RFC 9116 /.well-known/security.txt + PGP key + repo-root SECURITY.md with scope, safe harbour, CFAA/DMCA waiver
• /.well-known/gpc.json signalling Global Privacy Control support

Nine new legal pages under app/(legal)/

Affirmative opt-in + policy updates

• ConsentGatedRegistration wraps passkey + email sign-up with three checkboxes: age attestation (13+/16+ EEA/UK), terms/privacy/AUP/cookie acceptance, optional marketing opt-in. GDPR Art 7 + UK ICO Age-Appropriate Design Code compliant
• Privacy policy: replaced placeholder EU rep block with full Article 27 EU + UK rep language, plus supervisory-authority list (EDPB, ICO, CPPA, OPC, OAIC, ANPD)
• Legal sidebar expanded from 8 → 17 entries; sitemap.ts + robots.ts updated (robots now allows /.well-known/)
• Domain normalisation: 32 occurrences of alecrae.dev → alecrae.com across terms, AUP, DMCA, DPA, SLA, cookies, subprocessors, privacy, dashboard/domains

Closes Known Issues #15–#22 in CLAUDE.md.

Test plan

• bun run build green — 31 static pages including all 17 legal routes
• bun run test — 11/11 consent-library tests pass (jsdom environment)
• No regressions in existing typecheck baseline (pre-existing packages/ui errors untouched; zero new errors in the 17 new files)
• Manual: open landing page → ConsentBanner appears on first visit, GPC/DNT auto-selects reject
• Manual: /register → form disabled until age + terms checkboxes ticked
• Manual: /.well-known/security.txt resolves and validates against RFC 9116
• Manual: every route in sidebar (17) loads; cookie-preferences link re-opens banner