Prompt users with stale terms_version to re-accept

The three pre-legal-disclaimer users (ullrich, pistazie, nelli) have
NULL terms_version, and any future Terms update would leave every
existing user in the same state. Close the loop now that we have
version storage by redirecting any logged-in user whose
users.terms_version doesn't match the currently-published
TERMS_VERSION to a dedicated acceptance page.

Changes:
- auth.server: new recordTermsAcceptance(userId, version) helper that
  writes both terms_accepted_at and terms_version.
- root loader: if the session user has a stale or NULL terms_version,
  throw redirect("/auth/accept-terms?returnTo=<pathname>") unless the
  request is already on an allow-listed path
  (/auth/accept-terms, /auth/logout, /legal/*) so Terms are reachable
  and logout works.
- New route /auth/accept-terms (GET renders the prompt, POST records
  acceptance and bounces to a sanitised returnTo). Same-origin check
  on returnTo to avoid open-redirect abuse. Logout button is provided
  as an escape hatch.
- i18n: new auth.reaccept.* keys for EN and DE.
- Spec: new Requirement + five scenarios (redirect, allow-list,
  successful re-accept, missing consent, returnTo sanitisation).

No action on the three legacy users is required beyond what they'll
experience on their next visit — the gate takes care of it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/root.tsx

@@ -1,5 +1,5 @@
 import { useEffect } from "react";
-import { Links, Meta, Outlet, Scripts, ScrollRestoration, isRouteErrorResponse, useLocation, Form, Link } from "react-router";
+import { Links, Meta, Outlet, Scripts, ScrollRestoration, isRouteErrorResponse, useLocation, Form, Link, redirect } from "react-router";
 import type { LinksFunction } from "react-router";
 import type { Route } from "./+types/root";
 import * as Sentry from "@sentry/react";
@@ -10,8 +10,17 @@ import { LocaleProvider } from "~/components/LocaleContext";
 import { AlphaBanner } from "~/components/AlphaBanner";
 import { Footer } from "~/components/Footer";
 import { initSentryClient, stopSentryClient } from "~/lib/sentry.client";
+import { TERMS_VERSION } from "~/lib/legal";
 import stylesheet from "@trails-cool/ui/styles.css?url";
 
+// Paths that must stay reachable even when the user has a stale
+// terms_version, so they can read the Terms, accept them, or log out.
+const TERMS_GATE_ALLOWLIST = [
+  "/auth/accept-terms",
+  "/auth/logout",
+  "/legal/",
+];
+
 export const links: LinksFunction = () => [{ rel: "stylesheet", href: stylesheet }];
 
 export function Layout({ children }: { children: React.ReactNode }) {
@@ -39,6 +48,20 @@ export function Layout({ children }: { children: React.ReactNode }) {
 export async function loader({ request }: Route.LoaderArgs) {
   const user = await getSessionUser(request);
   const locale = detectLocale(request);
+
+  // Gate logged-in users with stale / missing terms_version: send them to the
+  // re-accept page on any request that isn't already on an allow-listed path.
+  if (user && user.termsVersion !== TERMS_VERSION) {
+    const pathname = new URL(request.url).pathname;
+    const onAllowlistedPath = TERMS_GATE_ALLOWLIST.some((p) =>
+      p.endsWith("/") ? pathname.startsWith(p) : pathname === p,
+    );
+    if (!onAllowlistedPath) {
+      const returnTo = encodeURIComponent(pathname + new URL(request.url).search);
+      throw redirect(`/auth/accept-terms?returnTo=${returnTo}`);
+    }
+  }
+
   return { user: user ? { id: user.id, username: user.username } : null, locale };
 }