docs(privacy): state the two local values PostHog actually stores (#1242)

* docs(privacy): state the two local values PostHog actually stores

Verified in production after Support went live: PostHog's conversations
module writes ph_conv_<token> = {"widgetSessionId": uuid} to
localStorage at PAGE LOAD, before the user contacts support at all, and
it bypasses persistence: 'memory' exactly like surveys' seenSurvey_
flags do.

The privacy page claimed enkäter were the only thing stored locally.
That became wrong the moment Support was enabled, so it now names both
values and what they are for.

The substance is unchanged: both are functional UI state with no
personuppgifter (do-not-ask-again, and find-my-own-ticket in this
browser), no cookies are set, and no analytics data is stored on the
device, so the no-consent-banner position still holds. Only the claim
needed to match reality.

Lesson recorded in DECISIONS.md: enabling any new PostHog product can
silently add device storage, so check localStorage in prod after each
one rather than trusting the persistence setting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(compliance): inventory the client-side storage keys

Closes the ISO 27001 A.5.9 finding from the compliance swarm on #1242:
the two device-side keys were described in prose but were not enumerated
anywhere that a future change would be checked against.

Lists both application keys and both PostHog keys, what each contains,
why neither PostHog key is personal data (which is what makes the
strictly-necessary assessment hold), and why purge-legacy-storage
deliberately leaves them alone.

Adds the review trigger that would have caught this earlier: enabling a
new PostHog product can silently add storage, because the products write
to localStorage directly rather than through the SDK persistence setting.
The Support product was found in prod, not in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(public)/privacy/page.tsx

@@ -162,9 +162,13 @@ export default function PrivacyPolicyPage() {
                       gränssnittet du klickar, aldrig vad som står i din
                       bokföring. Organisationsnummer överförs aldrig.
                       Identifiering sker endast för inloggade användare (ej
-                      sandbox/demo). Inga kakor eller annan lagring på din
-                      enhet används för analysen; enkäter sparar enbart en
-                      lokal markering om att du redan sett dem.
+                      sandbox/demo). Inga kakor används, och själva analysdatan
+                      lagras inte på din enhet. Två små tekniska värden sparas
+                      dock lokalt: en markering om vilka enkäter du redan sett,
+                      så att du inte får samma fråga igen, och ett
+                      slumpmässigt ärende-ID som gör att du hittar tillbaka
+                      till ditt supportärende i samma webbläsare. Inget av dem
+                      innehåller personuppgifter.
                     </td>
                     <td className="py-2 pr-4">EU (Frankfurt)</td>
                     <td className="py-2">