feat(website): real DPA + privacy policy pages
Replace the /dpa and /privacy placeholder stubs with full pages (da + en):
- /dpa — GDPR Art. 28 data processing agreement: roles, subject matter, data
categories, processor obligations, sub-processors (Hetzner, Stripe — EU),
no third-country transfer, 72h breach notice, audits, deletion, Danish law.
- /privacy — controller privacy notice: data collected, legal basis, cookieless
Umami analytics, retention, recipients, data-subject rights + Datatilsynet.
Both carry a "draft — pending legal review" banner. Removes their stub entries.
Ronni Baslund
bc0697c3e8