feat(bf): gate the Google Ads tag behind a consent banner; fire the buy-click conversion proxy

/odoo-black-friday/ only, page-side. No Odoo change, no ad-account change.

- static/ads-consent.js (new): default-DENY consent; nothing loads and no request
  fires until Accept. On Decline (or switching to Decline later) the _gcl_au/_gcl_aw
  cookies are cleared. A footer "Cookie settings" link reopens the banner.
- conversion: on submit of either /shop/post_basket buy form (offer block + On the
  Rise card), gtag('event','conversion',{send_to: AW-18065522009/vnDUCPDxt7AdENn6p6ZD})
  then form.submit() from event_callback, with a 700 ms hard-timeout fallback so a
  blocked tag can never swallow the buy. No consent / no tag -> native POST untouched.
- privacy.html: new "Advertising cookies" disclosure (what, why, how to decline).
- Plausible Buy marks and the checkout-side Purchase event untouched.

privacy.html

@@ -121,7 +121,7 @@
             <div class="container">
                 <h1>Privacy Policy</h1>
                 <p style="margin-top: 0.5rem; color: rgba(33, 37, 41, 0.6); font-size: 0.85rem;">
-                    Last updated 2026-10-21
+                    Last updated 2026-11-02
                 </p>
             </div>
         </section>
@@ -173,6 +173,14 @@
                     <p>Our pages load Stripe (payments), Google Fonts, Font Awesome, GSAP, and our own agent widget from our server. Like any website, these requests can see the IP address your browser connects from.</p>
                 </div>
 
+                <div class="legal-card">
+                    <h2>Advertising cookies</h2>
+                    <p>On our Black Friday page we would like to measure our advertising with Google Ads. This is optional, and it is off until you turn it on.</p>
+                    <p>If you accept, the Google Ads tag loads and sets advertising cookies (named <strong>_gcl_au</strong> and <strong>_gcl_aw</strong>). They let Google tell us which ad or search led to a visit, so we spend our budget on the ads that work. They do not change what you pay, and we do not sell your data.</p>
+                    <p>If you decline, the tag does not load and those cookies are not set. The page works the same either way. You can change your choice at any time with the &ldquo;Cookie settings&rdquo; link in the footer of the Black Friday page, or by clearing cookies in your browser.</p>
+                    <p>Our privacy-friendly analytics are separate: they set no cookies and collect no personal data.</p>
+                </div>
+
                 <div class="legal-card">
                     <h2>Email</h2>
                     <p>We email you about your account, your invoices and your service. Marketing email carries an unsubscribe link, and unsubscribing does not stop service email about an active account.</p>