Add Google Analytics 4 (G-WVYV807VSS) with Consent Mode v2

- gtag.js injected on all 201 pages via tools/seo_inject.py + on 404.html
- Consent Mode v2 defaults all storage to 'denied' (EEA-safe: tag loads,
  no tracking cookies until a consent banner grants analytics_storage)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

404.html

@@ -6,6 +6,19 @@
     <title>Page not found - MSOS</title>
     <meta name="robots" content="noindex">
 
+    <!-- Google tag (gtag.js) with Consent Mode v2 (default: denied) -->
+    <script async src="https://www.googletagmanager.com/gtag/js?id=G-WVYV807VSS"></script>
+    <script>
+      window.dataLayer = window.dataLayer || [];
+      function gtag(){dataLayer.push(arguments);}
+      gtag('consent', 'default', {
+        ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied',
+        analytics_storage: 'denied', wait_for_update: 500
+      });
+      gtag('js', new Date());
+      gtag('config', 'G-WVYV807VSS');
+    </script>
+
     <!-- Root-absolute paths: a 404 is served under the requested URL, so
          relative paths would resolve against the wrong directory. -->
     <link rel="preconnect" href="https://fonts.googleapis.com">