Prepare for going public: legal pages, corrections contact, portrait proxy

/impressum and /datenschutz read the operator's details from the environment
so they stay out of this repository, and show a visible notice until set.
Portraits go through an allowlisted /api/img so visitors' IPs stay with us.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap.md

@@ -33,6 +33,7 @@ Next.js frontend (de/en), Docker Compose for Unraid.
       party/institution channels; curated `social_accounts.yaml`
 - [x] X deletion sync (`social.x_deletions`): posts gone from X keep a marked record without their text
 - [x] EP final roll-call votes of Austrian MEPs (`europarl.votes`)
+- [x] Draft legal pages (`/impressum`, `/datenschutz`), corrections contact, portrait proxy (`/api/img`)
 - [x] Pages: organisations, money explorer, social feed, Wikipedia edits, person network ("follow the money"),
       say-vs-vote on roll calls
 
@@ -59,8 +60,8 @@ Next.js frontend (de/en), Docker Compose for Unraid.
 - [ ] Wayback Machine archiving of evidence URLs (`document.archive_url`)
 
 **Product**
-- [ ] Before going public: Impressum/Offenlegung (§ 5 ECG, § 25 MedienG), privacy policy, a corrections contact
-- [ ] Image proxy for portraits and logos (no visitor IPs to Wikimedia/parliament)
+- [ ] Before going public: have `/impressum` and `/datenschutz` legally reviewed, set `POLITRACK_LEGAL_*` in `.env`,
+      and document the balancing test (see legal.md)
 - [ ] Compare two people or parties; topic pages (`/themen/{slug}`); Open Graph share images; CSV export
 - [ ] Review queue for editors in the web UI (today `politrack review`)
 - [ ] Community link submissions and a corrections/right-of-reply form