Prompt users with stale terms_version to re-accept

The three pre-legal-disclaimer users (ullrich, pistazie, nelli) have
NULL terms_version, and any future Terms update would leave every
existing user in the same state. Close the loop now that we have
version storage by redirecting any logged-in user whose
users.terms_version doesn't match the currently-published
TERMS_VERSION to a dedicated acceptance page.

Changes:
- auth.server: new recordTermsAcceptance(userId, version) helper that
  writes both terms_accepted_at and terms_version.
- root loader: if the session user has a stale or NULL terms_version,
  throw redirect("/auth/accept-terms?returnTo=<pathname>") unless the
  request is already on an allow-listed path
  (/auth/accept-terms, /auth/logout, /legal/*) so Terms are reachable
  and logout works.
- New route /auth/accept-terms (GET renders the prompt, POST records
  acceptance and bounces to a sanitised returnTo). Same-origin check
  on returnTo to avoid open-redirect abuse. Logout button is provided
  as an escape hatch.
- i18n: new auth.reaccept.* keys for EN and DE.
- Spec: new Requirement + five scenarios (redirect, allow-list,
  successful re-accept, missing consent, returnTo sanitisation).

No action on the three legacy users is required beyond what they'll
experience on their next visit — the gate takes care of it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/lib/auth.server.ts

@@ -410,6 +410,19 @@ export const sessionStorage = createCookieSessionStorage({
   },
 });
 
+/**
+ * Record the user's acceptance of the current Terms version. Updates both
+ * `terms_accepted_at` (NOW) and `terms_version`. Used when an existing user
+ * re-accepts after the Terms have been updated.
+ */
+export async function recordTermsAcceptance(userId: string, termsVersion: string) {
+  const db = getDb();
+  await db
+    .update(users)
+    .set({ termsAcceptedAt: new Date(), termsVersion })
+    .where(eq(users.id, userId));
+}
+
 export async function createSession(userId: string, request: Request) {
   const session = await sessionStorage.getSession(request.headers.get("Cookie"));
   session.set("userId", userId);