feat: add privacy policy page and fix CSP blocking API docs

Add a privacy policy page accessible at /privacy (public, no auth required).
Relax Content-Security-Policy for /api/docs route to allow Scalar's inline
script initialization, fixing blank docs page in production.

apps/web/src/components/layout/app-layout.tsx

@@ -124,7 +124,9 @@ export function AppLayout({ children, showToolPanel = true, onFiles }: AppLayout
         </div>
         {!isMobile && (
           <div className="text-center text-xs text-muted-foreground py-2 border-t border-border">
-            Privacy Policy
+            <Link to="/privacy" className="hover:text-foreground transition-colors">
+              Privacy Policy
+            </Link>
           </div>
         )}
       </main>