feat: add GDPR consent banner gating GA4

[jmeridth]

What

Add a hand-rolled GDPR cookie/analytics consent banner that gates GA4 loading on explicit user action. New `_includes/consent_banner.html` ships the dialog markup (hidden by default via the `hidden` attribute). New `assets/js/consent.js` owns show/hide logic, keyboard accessibility, localStorage persistence, and dynamic injection of `gtag.js` only after the user clicks Accept. `assets/css/custom.css` gets the banner styling appended (themed via Bulma CSS variables so it adapts to dark mode automatically). `_includes/footer.html` is rewritten to emit `window.GA_MEASUREMENT_ID` via Liquid's `jsonify` filter, include the banner markup, load `consent.js`, and add a "Cookie preferences" footer link that re-opens the banner after a choice has been made.

Why

PR #81 added the GA4 measurement tag but loaded `gtag.js` unconditionally on every production page view — not GDPR-compliant for EU visitors. This PR gates the GA4 script injection on an explicit "Accept all" click; "Decline non-essential" records the choice and never loads any third-party tracking. Escape dismisses without recording, so the banner re-appears on the next visit (consent must be explicit, not implicit). The implementation is hand-rolled to match the codebase's existing posture (theme.js follows the same pattern); if more third-party scripts are added later, switching to a library with category-based consent (`cookieconsent` v3, Klaro) would scale better.

Notes

• The banner is non-modal (no `aria-modal`): page scrolling is not blocked. `role="dialog"` is declared, Escape closes, focus moves to the Decline button on show and restores on close. Focus trap is intentionally not implemented since the banner is non-modal.
• GA4 ID is interpolated via `{{ site.google_analytics_id | jsonify }}` rather than bare string concat, so future `_config.yml` values containing quotes or `</script>` cannot escape the JS string context.
• A `window.ANALYTICS_DRY_RUN` flag is set in non-production builds. In that mode, `consent.js` logs `[consent] dry run: ...` to console instead of injecting `gtag.js` — local testing of the banner UI does not pollute production analytics.
• A three-model security review (opus/sonnet/haiku) flagged three additional findings that were considered and intentionally not addressed in this PR:
  • localStorage tampering: any same-origin script can set `localStorage['analytics-consent'] = 'accepted'` and bypass the banner on the next load. Accepted risk — no first-party untrusted scripts run on the site, and HMAC-signing the consent value is overkill for a personal blog.
  • Inline scripts block strict CSP: `_includes/footer.html` and `_includes/head.html` both have inline `<script>` blocks. A future `script-src 'self'` CSP would require nonces or moving the data to meta tags. Deferred — CSP is not currently on the roadmap.
  • `JEKYLL_ENV=production` not asserted at build time: if a future deploy mechanism forgets to set the env var, `ANALYTICS_DRY_RUN` would silently ship to production and analytics would never fire. GitHub Pages currently sets this automatically; deferred.

Testing

Verified locally with cache wiped (`rm -rf _site .jekyll-cache`) and `bundle exec jekyll serve --livereload --future`:

• First visit: banner appears at bottom of page with Decline / Accept buttons.
• Click Accept: banner hides, DevTools console logs `[consent] dry run: would load GA4 with id "G-6DK8Y2SBT2"`, no network request to `googletagmanager.com` (because `ANALYTICS_DRY_RUN` is true locally), `localStorage['analytics-consent'] === 'accepted'`.
• Click Decline: banner hides, no console log, `localStorage['analytics-consent'] === 'declined'`, no GA4 load.
• Press Escape while banner is showing: banner hides, no localStorage entry written.
• Reload after Escape: banner re-appears (consent must be explicit, no decision recorded).
• Reload after Accept or Decline: banner stays hidden.
• Click Cookie preferences in footer: banner re-opens, can change choice.
• Keyboard a11y: Tab moves focus into Decline button when banner is open; Escape closes; focus returns to the previously-focused element after close.
• DevTools Network tab in production (after merge + deploy): clicking Accept should produce the request to `https://www.googletagmanager.com/gtag/js?id=G-6DK8Y2SBT2\`. Visits should appear in Google Analytics → Reports → Realtime within ~30s.