docs(website): add cookieless Umami analytics + a privacy page

Wire self-hosted Umami (umami.oliversturm.com) into the site head:
- data-domains=relplay.org so the preview/staging deploys don't pollute
  the production stats
- data-do-not-track so DNT visitors aren't counted
- the Website ID is public by design (ships in every page)

Add a short /privacy page (footer-linked, kept out of the sidebar)
explaining the no-cookies / no-personal-data / no-cross-site-tracking
posture and the DNT behaviour. No cookie banner is needed: the tracker
stores nothing on the device, and first-party statistical analytics is
exempt from PECR consent under the Data (Use and Access) Act 2025.

website/astro.config.mjs

@@ -58,6 +58,25 @@ export default defineConfig({
 				},
 				{ tag: 'meta', attrs: { name: 'twitter:card', content: 'summary_large_image' } },
 				{ tag: 'meta', attrs: { name: 'twitter:image', content: 'https://relplay.org/og-card.png' } },
+				// Privacy-friendly, cookieless analytics (self-hosted Umami). The
+				// Website ID is public by design (it ships in every page). The script
+				// loads from the Umami host, which also becomes the data destination,
+				// so no `data-host-url` is needed.
+				//   - data-domains: only run on the production apex, so the
+				//     `website.relplay.pages.dev` preview and `staging.relplay.org`
+				//     don't pollute the stats.
+				//   - data-do-not-track: honour the browser's Do-Not-Track signal
+				//     (those visits are not counted at all). See /privacy.
+				{
+					tag: 'script',
+					attrs: {
+						defer: true,
+						src: 'https://umami.oliversturm.com/script.js',
+						'data-website-id': 'fd77cfa5-cffe-4fc8-addb-1c6d7b6d9939',
+						'data-domains': 'relplay.org',
+						'data-do-not-track': true,
+					},
+				},
 			],
 			// Register the simple-mode command grammar with Expressive Code (Shiki).
 			expressiveCode: { shiki: { langs: [rdbmsLang, rdbmsSyntax] } },