feat: add privacy policy; wire GA4 and Umami at build time

- /privacy/ page covering the contact form (Formspree), Umami, GA4 and
  server logs; linked from the footer
- Analytics.astro: GA4 alongside Umami, both limited to the production
  host so staging and local builds are not counted
- Dockerfile ARGs + CI build args from repo Actions variables
  GA_MEASUREMENT_ID and UMAMI_WEBSITE_ID (non-secret)

Dockerfile

@@ -12,8 +12,14 @@ WORKDIR /app
 # .gitea/workflows/ci.yml.
 ARG PUBLIC_CONTACT_FORM_ENDPOINT=""
 ARG PUBLIC_SITE_URL="https://www.bluecapstrategies.com"
+ARG PUBLIC_GA_MEASUREMENT_ID=""
+ARG PUBLIC_UMAMI_SRC="https://stats.bluecapstrategies.com/script.js"
+ARG PUBLIC_UMAMI_WEBSITE_ID=""
 ENV PUBLIC_CONTACT_FORM_ENDPOINT=$PUBLIC_CONTACT_FORM_ENDPOINT \
-    PUBLIC_SITE_URL=$PUBLIC_SITE_URL
+    PUBLIC_SITE_URL=$PUBLIC_SITE_URL \
+    PUBLIC_GA_MEASUREMENT_ID=$PUBLIC_GA_MEASUREMENT_ID \
+    PUBLIC_UMAMI_SRC=$PUBLIC_UMAMI_SRC \
+    PUBLIC_UMAMI_WEBSITE_ID=$PUBLIC_UMAMI_WEBSITE_ID
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN npm run build