feat: add privacy policy; wire GA4 and Umami at build time

- /privacy/ page covering the contact form (Formspree), Umami, GA4 and
  server logs; linked from the footer
- Analytics.astro: GA4 alongside Umami, both limited to the production
  host so staging and local builds are not counted
- Dockerfile ARGs + CI build args from repo Actions variables
  GA_MEASUREMENT_ID and UMAMI_WEBSITE_ID (non-secret)

.gitea/workflows/ci.yml

@@ -98,9 +98,13 @@ jobs:
           # deploy time. CONTACT_FORM_ENDPOINT is the Formspree URL; set it as a repo Actions
           # secret. If it is empty the build still succeeds and the contact form degrades to a
           # mailto draft, so a missing secret is survivable but should be caught in review.
+          # GA_MEASUREMENT_ID / UMAMI_WEBSITE_ID are non-secret repo Actions *variables*
+          # (Settings → Actions → Variables); empty means that tracker is simply left out.
           docker build \
             --build-arg PUBLIC_CONTACT_FORM_ENDPOINT="${{ secrets.CONTACT_FORM_ENDPOINT }}" \
             --build-arg PUBLIC_SITE_URL="https://www.bluecapstrategies.com" \
+            --build-arg PUBLIC_GA_MEASUREMENT_ID="${{ vars.GA_MEASUREMENT_ID }}" \
+            --build-arg PUBLIC_UMAMI_WEBSITE_ID="${{ vars.UMAMI_WEBSITE_ID }}" \
             -t "$PUSH_IMAGE:${{ steps.tag.outputs.sha }}" -t "$PUSH_IMAGE:latest" .
           # Registry pushes can time out on a slow blob; docker push is resumable, so retry.
           push_retry() {