Add configurable legal pages (Impressum, Privacy, Terms) to template

Every page now shows Impressum, Privacy Policy and Terms of Use links in
the sidebar footer, and the GDPR consent banner links to the privacy
policy so consent and policy are tied together. Links default to the
official OpenMS pages and are overridable via a new "legal_links" object
in settings.json, so self-hosting forks can point them at their own legal
pages (an Impressum must name the actual operator).

- settings.json: add legal_links (impressum/privacy/terms) defaults
- common.py: add get_legal_links() (settings overrides merged over the
  hardcoded OpenMS defaults, so older forks still inherit links) and
  render the three links in the sidebar on every page
- captcha_.py: forward the privacy policy URL to the consent component
- gdpr_consent: set Klaro privacyPolicyUrl so the banner shows a working
  privacy-policy link; rebuild dist/bundle.js
- README: document the legal_links override
- tests: cover get_legal_links default/override/fallback behavior

https://claude.ai/code/session_01WCamMNCunp9T2aScEKKUvx

Author: claude

README.md

@@ -164,6 +164,27 @@ nginx config, PID files — to `/tmp/openms-runtime-$$`, which is always
 writable inside an apptainer container. The workspace cleanup cron job is
 skipped in this mode; rerun `clean-up-workspaces.py` manually if needed.
 
+## ⚖️ Legal pages (Impressum, Privacy Policy, Terms of Use)
+
+Every page shows **Impressum**, **Privacy Policy** and **Terms of Use** links at
+the bottom of the sidebar, and the GDPR consent banner links to the privacy
+policy. By default these point to the centrally maintained official OpenMS pages
+(`https://openms.de/impressum`, `/privacy`, `/terms`).
+
+If you self-host a fork, override them in `settings.json` — an Impressum must
+name the **actual operator**, not OpenMS:
+
+```json
+"legal_links": {
+    "impressum": "https://your-domain.example/impressum",
+    "privacy": "https://your-domain.example/privacy",
+    "terms": "https://your-domain.example/terms"
+}
+```
+
+Any link you omit falls back to its OpenMS default. The `privacy` URL is reused
+for the consent banner's privacy-policy link, so consent and policy stay in sync.
+
 ## Documentation
 
 Documentation for **users** and **developers** is included as pages in [this template app](https://abi-services.cs.uni-tuebingen.de/streamlit-template/), indicated by the 📖 icon.

gdpr_consent/dist/bundle.js

@@ -14,6 +14,7 @@ let klaroConfig: {
     mustConsent: boolean;
     acceptAll: boolean;
     services: Service[];
+    translations?: Record<string, any>;
 } = {
     mustConsent: true,
     acceptAll: true,
@@ -125,6 +126,18 @@ function onRender(event: Event): void {
         )
     }
 
+    // Link the consent banner to the privacy policy. Setting privacyPolicyUrl
+    // on the 'zz' fallback language makes Klaro render its default
+    // "To learn more, please read our privacy policy." text with the URL,
+    // regardless of the browser locale.
+    if (data.args['privacy_policy']) {
+        klaroConfig.translations = {
+            zz: {
+                privacyPolicyUrl: data.args['privacy_policy']
+            }
+        }
+    }
+
     // Create a new script element
     var script = document.createElement('script')
 

gdpr_consent/src/main.ts

@@ -3,6 +3,11 @@
     "github-user": "OpenMS",
     "version": "1.1.1",
     "repository-name": "streamlit-template",
+    "legal_links": {
+        "impressum": "https://openms.de/impressum",
+        "privacy": "https://openms.de/privacy",
+        "terms": "https://openms.de/terms"
+    },
     "analytics": {
         "google-analytics": {
             "enabled": false,