Load Google Analytics only after consent #83

Priority: high (privacy; the site sells to schools).

src/components/Analytics.astro loads gtag on every page with Consent Mode v2 set to denied. Its own comment says that with consent denied, GA "still loads and still sends Google a cookieless ping". So "no cookies until you agree" is true, but "no contact with Google until you agree" isn't. A school's data-protection lead will ask about exactly that.

Fix

• Don't load the GA loader at all until analytics consent is granted. CookieBanner.astro injects it when the visitor agrees, or on load when a stored consent says yes.
• Check the stored consent's version (CONSENT_KEY, and the v it carries) in both Analytics.astro and SupportWidget.astro. Consent from an older banner version must count as not given.
• Privacy policy (src/data/legal.ts): it can then say Google is contacted only after you agree. Keep it word-for-word true.
• Tests (tests/security.test.ts): no googletagmanager request before consent; one after; none for an old consent version.
• Probe: run the existing consent probe (npm run consent:probe).