feat(site): publish learner data controls

[hcs-platform-app]

Outcome

Publishes an honest, accessible learner-data experience backed by the reusable Project 42 policy contract.

Learners can now

• see exactly what remains private to their browser today
• inspect the planned account lifecycle, consent choices, retention, export, deletion, recovery, roles, and tenant boundaries
• inspect the exact machine-readable policy at /learner-data/policy
• reach the policy from My progress, the footer, the sitemap, and release facts

Guardrails

• no account or hosted learner-data collection is enabled
• identity remains issuer/subject based; email is never authoritative
• release facts identify policy 2026-07-25, D1 hosted storage, and PostgreSQL reference storage
• WCAG contrast defect [project-42.dev] Fix learner-data policy label contrast #57 / AB#5688 was reproduced and fixed before release

Validation

• full npm run check passed
• 16 rendered-route tests
• 7 link unit tests
• 126 HTML routes and 4 endpoints
• 5,227 internal references, 39 assets, and 139 external links
• 9 browser journeys including WCAG A/AA learner-data coverage
• zero production dependency vulnerabilities
• independent Claude Haiku review: APPROVED

Tracks AB#5684, AB#5687, and AB#5688.

[kristopherjturner]

Approved after independent cross-family review and green CI run 30183120518 on commit f6c645d. Local validation and GitHub Actions cover build, rendered routes, links, browser accessibility, and dependency audit.