feat(share-web): real Terms and Privacy pages

[graydawnc]

What

• /privacy — written from the codebase's actual behavior, summary-first: local-first stance (library never uploaded; only explicit publishes leave the machine), the Google OAuth scopes statement (openid/email/profile, used for sign-in only — required wording for Google's brand verification), what is and isn't collected (no analytics/trackers/ads; session cookie 30d sliding/90d cap; daily-salted irreversible IP/UA hashes in the audit log), Cloudflare + Google as the only processors, public-content caveats, permanent unpublish, 24h deletion grace + hard cascade, 30-day infrastructure-backup expiry, self-service rights via /me.
• /terms — deliberately minimal for a free service: as-is provision (with a wind-down notice promise), content ownership + the hosting/display license, publisher responsibility (conversations can contain third-party / AI content), permanent-unpublish semantics, six use restrictions that the Reader's report link and abuse@spool.pro anchor to, removal/termination, the paid-us-zero liability cap. No billing clauses, no governing-law clause; the operator self-identifies as spool.pro.
• Footer renders Terms · Privacy site-wide again (Reader keeps Report this share in front) — undoing the chore(share-web): drop placeholder Terms / Privacy / Learn-more footer #378 placeholder removal with real pages.
• /sign-in gains the customary "By signing in you agree to…" line.
• _headers: /terms + /privacy drop the site-wide X-Robots-Tag: noindex (the one surface we want indexable; Google's verification fetches the privacy URL) and get the static-page CSP.

Both documents credit "Structure adapted from the Basecamp open-source policies (CC BY 4.0)" in-page.

Post-merge ops (GA checklist)

• Create the hello@spool.pro and abuse@spool.pro routes in Cloudflare Email Routing.
• In Google Cloud Console → OAuth consent screen (Branding), set the Privacy Policy and Terms URLs to https://spool.pro/privacy / https://spool.pro/terms so the consent screen links them, and run brand verification.

Test plan

• Route tests cover /terms, /privacy, trailing-slash normalization, and subpath → tombstone (70 share-web tests green); typecheck + production build green.
• Review pass verified the policy text against code: session TTLs (session.ts), daily-salted hashes (audit.ts), 24h grace (me/delete.ts). SPA fallback for the new paths uses the same mechanism as /me and /sign-in.
• Content reviewed locally on the dev server, including dark mode.

🤖 Generated with Claude Code