feat(legal): public privacy policy, terms, and homepage for OAuth verification

Adds login-free /privacy and /terms pages (rendered outside the authenticated
tree via a pathname switch in main.tsx) carrying the Google API Services Limited
Use disclosure, YouTube ToS / Google Privacy links, and contact + data-deletion
info. The sign-in screen now describes the app and links to both, satisfying
Google's homepage + privacy-policy requirements for the OAuth consent screen.

frontend/src/main.tsx

@@ -3,18 +3,28 @@ import { createRoot } from "react-dom/client";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import App from "./App";
 import ErrorBoundary from "./components/ErrorBoundary";
+import PrivacyPolicy from "./components/legal/PrivacyPolicy";
+import Terms from "./components/legal/Terms";
 import "./index.css";
 
 const queryClient = new QueryClient({
   defaultOptions: { queries: { retry: false, staleTime: 30_000, refetchOnWindowFocus: false } },
 });
 
-createRoot(document.getElementById("root")!).render(
-  <React.StrictMode>
+// Public, login-free legal pages. They live outside the authenticated App tree (no /api/me)
+// so Google's consent screen and reviewers can fetch them directly. Reached by full-page
+// navigation (plain <a href>), so a simple pathname switch is enough — no router needed.
+const path = window.location.pathname;
+const root =
+  path === "/privacy" ? <PrivacyPolicy /> :
+  path === "/terms" ? <Terms /> : (
     <QueryClientProvider client={queryClient}>
       <ErrorBoundary>
         <App />
       </ErrorBoundary>
     </QueryClientProvider>
-  </React.StrictMode>
+  );
+
+createRoot(document.getElementById("root")!).render(
+  <React.StrictMode>{root}</React.StrictMode>
 );