feat: add privacy policy; wire GA4 and Umami at build time

- /privacy/ page covering the contact form (Formspree), Umami, GA4 and
  server logs; linked from the footer
- Analytics.astro: GA4 alongside Umami, both limited to the production
  host so staging and local builds are not counted
- Dockerfile ARGs + CI build args from repo Actions variables
  GA_MEASUREMENT_ID and UMAMI_WEBSITE_ID (non-secret)

src/styles/global.css

@@ -1149,6 +1149,11 @@ textarea:focus {
   font-size: 0.92rem;
 }
 
+.footer-bottom a {
+  color: inherit;
+  text-decoration: underline;
+}
+
 .insights-shell {
   padding: 4rem 0;
   display: grid;