Add PointUp public privacy notice and homepage link

[jckail]

PointUp had no public privacy route or homepage privacy link. Add /privacy with the confirmed operator Jordan Kail and request contact jordan@quarg.io, and link it from the shared footer.

The notice describes the verified basic Google sign-in permissions and selected initial deployment, plus portfolio capture, sharing, browser storage and operational records. It explicitly explains bounded exports, soft deletion, manual privacy requests and the absence of automatic coordinated Clerk/portfolio erasure. The preserved review document records the publication scope and configuration checks still required at launch.

Validation: focused ESLint and web TypeScript passed. Chrome localhost checks verified all eight sections, working homepage navigation, valid section anchors and no horizontal overflow on desktop or at 390px. The temporary development server was stopped; its generated next-env change was restored. Hosted CI and CodeQL are required before merge.

The production Google account portal now authenticates successfully after the human credential handoff and approved identity consent. This is separate from renovated-app runtime acceptance. The owned refresh qualification run 37570187714 was cancelled because this source change requires a new exact-commit migration proof.

---

Note

Low Risk
Static marketing/legal copy and navigation only; no changes to authentication, data APIs, or privacy enforcement logic.

Overview
Adds a public privacy notice at /privacy for the renovated PointUp app, with Next.js metadata, in-page section navigation, and eight anchored sections covering account/Google sign-in (Clerk, basic profile only), portfolio data, browser extension capture and local storage, the rule-based assistant (no remote models at initial launch), share links, infrastructure (Clerk, Supabase, AWS), manual privacy requests at jordan@quarg.io, and retention limits including no automatic Clerk/portfolio erasure.

The shared site footer now includes a Privacy link to that route (via next/link), so it appears on every page that uses the root layout.

docs/privacy-launch-review.md gains an October 6 follow-up that records operator/contact confirmation, where the notice lives, launch-configuration scope (rule-based assistant, no email/chat delivery), and that deployment still needs verification of the HTTPS route, footer link, and Google branding privacy URL before treating implementation as publication.

^{Reviewed by Cursor Bugbot for commit 8973381. Bugbot is set up for automated code reviews on this repo. Configure here.}