Add legal policy pages and shared layout component

- Add Cookie Policy view documenting essential cookies (session, CSRF, remember_me, fa_location) and cookieless Umami analytics
- Add Privacy Policy view covering UK GDPR compliance, data categories, lawful bases, processors, retention, and user rights
- Add Refund & Cancellation Policy view explaining 14-day cooling-off period under Consumer Contracts Regulations 2013 and express-consent flow
- Add Terms of Service view defining account rules, subscription billing, and governing law
- Create shared legal layout component with FuelAlert header, footer with cross-links, and consistent typography
- Add feature tests covering all four legal pages and their cross-links
- All policies include placeholders for ICO registration number, email, and hosting/email providers pending production config

routes/web.php

@@ -24,5 +24,13 @@ Route::middleware(['auth'])->prefix('billing')->name('billing.')->group(function
     Route::get('/cancel', [BillingController::class, 'cancel'])->name('cancel');
 });
 
+// Server-rendered legal pages — must be registered before the SPA catch-all
+Route::prefix('legal')->name('legal.')->group(function () {
+    Route::view('/privacy', 'legal.privacy')->name('privacy');
+    Route::view('/terms', 'legal.terms')->name('terms');
+    Route::view('/refund', 'legal.refund')->name('refund');
+    Route::view('/cookies', 'legal.cookies')->name('cookies');
+});
+
 // SPA catch-all — must be last
 Route::get('/{any?}', fn () => view('app'))->where('any', '.*')->name('home');