fix(site): launch punch list (dead links, trust sub-processors, self-hosted icons)

[rclanan]

Pre-launch polish for mockforge.dev.

Links

• Fixed 404s: docs.mockforge.dev/plugins -> docs.mockforge.dev/user-guide/plugins.html; docs.mockforge.dev/CONFORMANCE_TESTING.html -> github.com/SaaSy-Solutions/mockforge/blob/main/docs/CONFORMANCE_TESTING.md (the guide is not in the mdBook); github.com/charmbracelet/kafka -> Kafka Streams testing docs.
• New scripts/check-links.mjs (npm run build:site && npm run check:links) scans the built site; CI runs --internal-only.
• Redirect pages for /notes, /blog, /docs, /security, /terms, /dpa. mockforge.dev/terms is linked from every registry transactional email and was a 404.

Trust / accuracy

• Sub-processors rewritten for the Ashburn cutover (evidence: saas-platform infrastructure/ashburn/{README,RUNBOOK,CUTOVER,Caddyfile}): Hetzner (API, app, Postgres), Fly.io (hosted mocks only; *.mocks.mockforge.dev stays on Fly), Cloudflare (edge, tunnel, R2), Stripe, Sentry, Brevo.
• "Encrypted at rest" narrowed to R2 object storage and backups: no evidence of disk encryption on the self-hosted Postgres host.
• Dated update callout on the infrastructure note.
• Privacy page no longer claims GA4 (it never loaded).
• llms.txt: api.mockforge.dev is the Cloud API, not a demo.

UX

• Enterprise "Contact sales" -> mailto:sales@mockforge.dev; JSON-LD contactPoints for sales, security, and technical support.
• Removed the dead GA4 scripts and the unused GA_MEASUREMENT_ID env.
• Phosphor icons are self-hosted (public/vendor/phosphor, woff2), so the site makes no unpkg requests.
• Copy-install button shows "Copied" text plus an aria-live status, with a fallback copy path.
• Mobile menu has aria-expanded. Checked at 375px.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}