cloud-v0.1.4

feat(cloud): privacy policy page (#107)

Google requires a privacy policy URL before an OAuth consent screen can be
published to production, so Option A is blocked without one — a gap the
design spec never mentioned. It is also a mandatory, human-reviewed input
to phase 3's sensitive-scope verification, so this is written for that
reader rather than to satisfy a form.

Every claim is checked against the code rather than boilerplate: the cloud
holds account email, argon2 hash, subdomain, billing state, hashed tunnel
tokens, bandwidth totals and heartbeat times; Stripe takes payment and
Resend delivers account mail; there is no analytics anywhere in the cloud
frontend; server error reports carry message, stack and route only, and are
off unless an address is configured.

The two honest disclosures matter most. Bug reports include a screenshot
and console log and land in a private repo — so the page says to check what
is on screen first. And the relay is described as what it is: a static page
with no server, holding the box address only in the visitor's own browser,
keyed to the sign-in attempt and cleared after use.

Marks phase 3's owner step O2 done.

Co-authored-by: dashboard-bot dashboard-bot@local

Deploy

On the provisioned VPS (see cloud/README.md for first-time provisioning):

sudo bash /opt/basis-cloud/current/deploy/update.sh --version cloud-v0.1.4

update.sh downloads this tarball, verifies its .sha256, migrates,
smoke-tests, swaps the current symlink, and auto-rolls-back if the
new version doesn't become healthy.