[grade=A] feat(legal): DC-056 ToS + Privacy pages with deploy + regression guard

Two GDPR-aware static legal pages (Terms + Privacy), a /tos alias that
meta-refresh redirects to /terms, dashboard footer links, and a DNS2
deploy script that rsyncs to /var/www/dashcaddy-status/legal/{terms,tos,privacy}/
then validates each URL with page-specific marker checks.

Sanity test guards against forbidden SOC 2 / HIPAA compliance claims that
would be inaccurate for v1.0 launch. Regex covers SOC[ -]?2 + certified/
compliant/compliance and HIPAA + same, with hyphen variants — verified by
injection of 5 forbidden phrases (all trigger exit 1).

Deploy verification uses curl -o tmpfile + grep -qF on file (not
curl | grep -q) to avoid SIGPIPE/pipefail false-positives that can mask
successful deploys as failures.

Routes: status.sami/legal/{terms,tos,privacy}
Aspirational legal.dashcaddy.net subdomain deferred to v1.x — needs DNS,
Caddy vhost, LE cert infra. Single canonical host covers launch.

Co-graded: Codex A urn:ump:khq6a3lwjwdkhd2hqwtds5pppzb7s2ft3t73sj5cz2hwgmb44owq

status/css/dashboard.css

@@ -3852,6 +3852,7 @@ button:focus-visible {
   display: flex;
   align-items: center;
   justify-content: center;
+  flex-wrap: wrap;
   gap: 14px;
   padding: 40px 0 20px;
   margin-top: 48px;
@@ -3873,3 +3874,7 @@ button:focus-visible {
   height: 140px;
   width: auto;
 }
+
+.footer-legal { display: flex; gap: 14px; font-size: 0.8rem; }
+.footer-legal a { color: var(--muted); text-decoration: none; }
+.footer-legal a:hover, .footer-legal a:focus-visible { color: var(--accent); text-decoration: underline; }