Add Google Analytics 4 (G-WVYV807VSS) with Consent Mode v2

- gtag.js injected on all 201 pages via tools/seo_inject.py + on 404.html
- Consent Mode v2 defaults all storage to 'denied' (EEA-safe: tag loads,
  no tracking cookies until a consent banner grants analytics_storage)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tools/seo_inject.py

@@ -71,6 +71,25 @@ FAVICON_LINES = [
     '    <link rel="manifest" href="/site.webmanifest">',
 ]
 
+# Google Analytics 4 (gtag.js) with Consent Mode v2 defaulting to DENIED
+# (EEA-compliant: tag loads but sets no tracking cookies until consent is
+# granted). A consent banner should call gtag('consent','update',{...}).
+GA_ID = "G-WVYV807VSS"
+GA_LINES = [
+    '    <!-- Google tag (gtag.js) with Consent Mode v2 (default: denied) -->',
+    f'    <script async src="https://www.googletagmanager.com/gtag/js?id={GA_ID}"></script>',
+    '    <script>',
+    '      window.dataLayer = window.dataLayer || [];',
+    '      function gtag(){dataLayer.push(arguments);}',
+    "      gtag('consent', 'default', {",
+    "        ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied',",
+    "        analytics_storage: 'denied', wait_for_update: 500",
+    "      });",
+    "      gtag('js', new Date());",
+    f"      gtag('config', '{GA_ID}');",
+    '    </script>',
+]
+
 # ---- page trees (for hreflang parity) ----
 def build_trees():
     trees = {}
@@ -227,6 +246,7 @@ def build_block(lang, path, content):
     ogimg = extract_og_image(content)
 
     lines = [START]
+    lines.extend(GA_LINES)
     if desc:
         lines.append(f'    <meta name="description" content="{html.escape(desc, quote=True)}">')
     lines.append(f'    <link rel="canonical" href="{canon}">')