fix(web): track consented cross-device signups

[shehjad-dev]

Why

Most clicks in the current YouTube campaign happen on mobile, while treg is mainly used on desktop. The existing server-side conversion path depends on a Google click ID reaching the browser where the team is created, so it cannot cover every mobile-click → desktop-signup journey.

Google Ads already has a separate website conversion action, treg Signup (web), but treg was not firing it. This PR wires up that action while keeping optional Google Ads measurement behind a clear browser choice.

What changed

• Added a site-wide Cookie choices banner for optional Google Ads measurement, with equally accessible Reject and Accept actions.
• Removed advertising consent from first-team onboarding. Creating a required team and choosing optional cookies are now separate decisions.
• Before acceptance, treg does not load Google's tag, send a consent-mode ping, or save the Google ad click in treg_ad.
• After acceptance, public marketing pages may load the Google Ads tag. A Google click ID (gclid, gbraid, or wbraid) is captured only when one is present.
• After the first team is created successfully, the dashboard fires treg Signup (web) only when that browser has already accepted optional cookies.
• The website event uses treg-web-signup-<org_id> as its transaction ID so a browser retry cannot count the same event twice inside that conversion action.
• Ordinary dashboard visits never load Google's tag. The dashboard loads it only for the accepted first-team conversion.
• Rejecting later updates consent and removes advertising cookies that treg can access on its domain.
• Added Review cookie choices under Privacy so the browser choice can be changed later.
• Kept the existing server-side signup, first_call, and paid outbox. New rows are now eligible on the next worker run instead of waiting six hours; retry and dead-letter behavior is unchanged.
• Updated the privacy policy, architecture/onboarding documentation, route snapshot, and regression coverage.

Who sees the banner

The current implementation is global rather than location-based. It is the simplest and safest starting point: any browser with no saved choice sees the banner on treg's public website/landing pages and signed-in dashboard, whether the visitor came from an ad or arrived organically.

The shared legal/information shell also shows it on Privacy, Terms, Support, and the Claude connector information page. The choice is stored for that browser and is not cleared by logout. Clearing browser data or using a fresh/private browser causes the banner to appear again.

Machine-to-machine surfaces do not show a banner: MCP v2, Codex/plugin calls, Grok plugin calls, terminal/CLI API traffic, and other JSON/MCP requests have no webpage. The CLI login page, treg MCP authorization page, and short provider OAuth callback result pages also do not show it because they load no Google measurement. If those flows return to the dashboard, the dashboard shows the banner when the browser has no saved choice.

The Facebook, Instagram, Google, and other provider authorization pages belong to those providers; treg cannot display its banner on their domains.

Result of each choice

• No choice: banner remains; optional Google Ads measurement stays off.
• Reject: the choice is remembered; Google Ads tag and click capture stay off.
• Accept without an ad click: Google Ads measurement can load on public marketing pages, but no treg_ad click cookie is created.
• Accept after an ad click: treg can capture the click ID and send the website signup after the first team succeeds.
• Accepted dashboard visit: no normal page tracking; Google loads only if the first-team signup event needs to be sent.

Location-based visibility later

The banner can become geo-aware later by adding a trusted country signal or a proper consent platform to the central consent module. At that point the team must choose the default outside regulated regions and update the privacy text and tests. The ad-click capture, signup event, and server uploader can continue using the same central consent state.

Google Ads configuration

Keep treg Signup (web) Secondary while it is being verified. It is separate from the server-side treg Signup action, so Google will not automatically deduplicate an event that reaches both actions. This PR does not close or modify #332.

Verification completed

• Browser: initial visit shows the banner and loads no Google tag.
• Browser: Reject hides the banner, survives reload/navigation, and keeps the Google tag absent on an ad landing URL.
• Browser: Privacy → Review cookie choices reopens the banner after either decision.
• Browser: Accept persists across pages and loads one Google Ads tag on a public ad destination.
• Browser: ordinary signed-in dashboard visits still load no Google tag.
• Targeted consent/conversion tests: 146 passed.
• Full suite: 3,802 passed, 6 skipped.
• Import architecture: 14/14 contracts kept.
• git diff --check: clean.

After merge and deployment

1. Confirm Shirley/Jason are comfortable with the banner wording and global policy.
2. Keep treg Signup (web) Secondary.
3. Use one real Google ad click and complete a real first-team signup from the accepted browser journey.
4. Confirm the website action receives the conversion in Google Ads. Allow for Google's reporting delay and check by conversion time/click date as appropriate.
5. Confirm the existing server-side signup/first-call/payment uploads still operate normally.
6. Let the campaign collect clean data for several days before changing bidding goals or strategy.
7. Once this replacement is accepted, decide whether to close feat(ads): add client-side website signup conversion for Google Ads #332.

Synthetic tests can prove the browser and server wiring, but only a real ad click can prove final attribution inside Google Ads.