Add privacy-friendly analytics and cookie consent, integrated into the CMS

Adds a first-party analytics system with no third-party trackers and no
persistent per-visitor identifiers: events are grouped into sessions via a
daily-rotating pseudonymous hash (IP+UA+host, HMAC-salted, never stored raw).

- New "Analytics" section in the Payload admin, gated by a canViewAnalytics
  permission on Users, following the existing custom-admin-view pattern
  used by the calendar feature
- Sessions, page views, unique visitors, top/entry/exit pages, events,
  device/browser breakdown, date range filter with period comparison
- Raw events and daily aggregate rollups as their own collections, with
  configurable retention and a cron endpoint that rolls up before purging
- Cookie consent banner (necessary/preferences/statistics) with categories
  and copy editable from a new CMS global; a track() helper that is a
  complete no-op without statistics consent, so nothing is ever sent
  before a visitor opts in
- track() calls wired into the booking flow, contact form, and navigation

setup.sh

@@ -301,6 +301,7 @@ POSTGRES_PASSWORD=
 POSTGRES_DB=anouma
 PAYLOAD_SECRET=
 MEETING_SESSION_SECRET=
+ANALYTICS_SALT_SECRET=
 CRON_SECRET=
 NEXT_PUBLIC_SERVER_URL=
 APP_PORT=3000
@@ -329,6 +330,7 @@ fi
 # --- secrets --------------------------------------------------------------
 env_ensure PAYLOAD_SECRET "$(gen_secret)" && log_info "PAYLOAD_SECRET generiert." || log_info "PAYLOAD_SECRET bereits vorhanden — unverändert."
 env_ensure MEETING_SESSION_SECRET "$(gen_secret)" && log_info "MEETING_SESSION_SECRET generiert." || log_info "MEETING_SESSION_SECRET bereits vorhanden — unverändert."
+env_ensure ANALYTICS_SALT_SECRET "$(gen_secret)" && log_info "ANALYTICS_SALT_SECRET generiert." || log_info "ANALYTICS_SALT_SECRET bereits vorhanden — unverändert."
 env_ensure CRON_SECRET "$(gen_secret)" && log_info "CRON_SECRET generiert." || log_info "CRON_SECRET bereits vorhanden — unverändert."
 
 if env_ensure POSTGRES_PASSWORD "$(gen_secret)"; then
@@ -431,6 +433,7 @@ echo "POSTGRES_DB:            $(env_get POSTGRES_DB)"
 echo "POSTGRES_PASSWORD:      $(mask "$(env_get POSTGRES_PASSWORD)")"
 echo "PAYLOAD_SECRET:         $(mask "$(env_get PAYLOAD_SECRET)")"
 echo "MEETING_SESSION_SECRET: $(mask "$(env_get MEETING_SESSION_SECRET)")"
+echo "ANALYTICS_SALT_SECRET:  $(mask "$(env_get ANALYTICS_SALT_SECRET)")"
 echo "CRON_SECRET:            $(mask "$(env_get CRON_SECRET)")"
 echo "SMTP_HOST:              $(env_get SMTP_HOST)"
 echo "SMTP_PASSWORD:          $(mask "$(env_get SMTP_PASSWORD)")"