feat(website): real DPA + privacy policy pages

Replace the /dpa and /privacy placeholder stubs with full pages (da + en):
- /dpa — GDPR Art. 28 data processing agreement: roles, subject matter, data
  categories, processor obligations, sub-processors (Hetzner, Stripe — EU),
  no third-country transfer, 72h breach notice, audits, deletion, Danish law.
- /privacy — controller privacy notice: data collected, legal basis, cookieless
  Umami analytics, retention, recipients, data-subject rights + Datatilsynet.
Both carry a "draft — pending legal review" banner. Removes their stub entries.

apps/website/pages/[slug].vue

@@ -17,8 +17,6 @@ const STUBS: Record<string, { legal: boolean }> = {
   status: { legal: false },
   docs: { legal: false },
   blog: { legal: false },
-  privacy: { legal: true },
-  dpa: { legal: true },
   terms: { legal: true },
   sla: { legal: true },
   cookies: { legal: true },