docs(privacy): disclose every cookie and browser-storage item (#56)

Completes the consent picture the rest of this branch builds. The claim worth being able to check is that no cookie needing permission is set before it is asked for, so the policy now lists everything rather than asserting it: the rd_session sign-in cookie, which is strictly necessary and therefore exempt, the two preferences kept in localStorage and never sent anywhere, and Brevo's cookie, which cannot exist unless analytics consent was given because the script that would set it is never loaded otherwise.

No cookie banner, and that is a finding rather than an omission. ePrivacy requires consent before storing anything non-essential, and this application does not store anything non-essential until the customer has asked for the feature that needs it. A banner would be asking permission for things that are either exempt or already separately consented to, which teaches people to dismiss the one consent that does matter.

Described in terms of what each thing does rather than by category, since a list of cookie names tells a customer nothing they can act on.

Refs #56

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/customer/PrivacyPolicy.tsx

@@ -51,6 +51,31 @@ export default function PrivacyPolicy() {
           your browser until you close the tab or clear it.
         </Paragraph>
 
+        <Title level={4}>Cookies and browser storage</Title>
+        <Paragraph>
+          We do not show a cookie banner, because until you ask for something that needs one we do
+          not set anything that requires your permission. Here is everything, so you can check that
+          claim rather than take it on trust:
+        </Paragraph>
+        <Paragraph>
+          <strong>A sign-in cookie (<code>rd_session</code>).</strong> Set only when you sign in,
+          and only so the site knows it is still you on the next page. It cannot be read by
+          JavaScript, is not shared with anyone, and is not used to track you. Signing out removes
+          it. This is what the rules call a strictly necessary cookie: without it, signing in would
+          not work at all, so it does not need — and we do not ask for — separate consent.
+        </Paragraph>
+        <Paragraph>
+          <strong>Two preferences kept in your browser</strong>, not cookies and never sent to us:
+          whether you chose the light or dark theme, and how many items you like to see per page.
+          They stay on your device and are readable only by this site. Clearing your browser data
+          removes them.
+        </Paragraph>
+        <Paragraph>
+          <strong>Brevo's tracking cookie — only if you opted in to sharing your activity.</strong>{' '}
+          If you have not, the script that would set it is never loaded, so the cookie never exists.
+          It is not set for signed-out visitors under any circumstances.
+        </Paragraph>
+
         <Title level={4}>Your rights</Title>
         <Paragraph>
           You may request a copy of your data ("Download my data" in your account page), or delete your