Big production-readiness pass before public launch. One commit because the
pieces are interlocking — the rename touches package metadata referenced by
the new marketing copy, the legal pages depend on the layout the marketing
pages introduced, and the VSIX hosting depends on the SITE_URL helper used
by the SEO fix.

═══ Brand: @devmind/* → @devmind-ai/* ═══
- npm scope rename across 231 files (sed-driven, all imports/refs updated)
- VS Code extension publisher: devmind → devmind-ai
- Marketplace ID: devmind-ai.devmind-vscode
- pnpm-lock.yaml regenerated
- Internal gitlab.aladintech.co URLs swept from publishable artifacts

═══ Marketing site (20 new pages + hubs) ═══
- /features: hub + 15 feature deep-dives covering all 30 user-facing
  backend modules (notifications, analytics, doc-gen, incident-postmortem,
  onboarding, ai-cost, identity, scm-integration, dependency, etc.)
- /integrations: hub + 5 channel deep-dives (vscode, cli, mcp, browser-ext, pwa)
- Reusable MarketingLayout with mega-menu nav (Features dropdown, Channels
  dropdown), keyboard a11y (focus-within + Escape + ARIA menu roles),
  prefers-reduced-motion support via MotionConfig + CSS media query
- 7 reusable marketing blocks: PageHero, FeatureGrid, Split, StepList,
  CodeBlock, CTASection, StatsRow, Faq, IconRow, InstallTabs
- FloatingChat extracted to standalone component, rendered globally
- Brand icons (Github/X/Linkedin) replaced with inline SVG (lucide brand
  icons deprecated upstream); social links converted to disabled buttons
  until real profiles exist

═══ SEO: env-driven canonical URL ═══
The previous static sitemap.xml + hardcoded "https://devmind.vn" canonical
links were the #1 reason the production deploy at devmind.aladintech.co
wasn't ranking — Google was treating every page as duplicate of an
unreachable canonical and refusing to index.
- New lib/site-url.ts helper reads NEXT_PUBLIC_SITE_URL with safe default
- /sitemap.xml + /robots.txt converted to dynamic Next.js pages
- 61 hardcoded devmind.vn references replaced with absUrl()
- Dockerfile.web accepts --build-arg NEXT_PUBLIC_SITE_URL

═══ VSIX / ZIP direct-download distribution ═══
VS Code Marketplace publish requires Azure DevOps + subscription verification
which is currently blocked. Pivoted to direct download (legitimate primary
distribution channel for pre-launch dev tools).
- VSIX (101 KB) + browser-extension ZIP (30 KB) hosted at
  /downloads/* in apps/web/public
- Marketing tabs reordered: Direct download = recommended,
  Marketplace tab = "coming soon"
- Real <Download> buttons with file size + version
- scripts/release-vsix.sh: idempotent build + sync + sed marketing copy
- scripts/publish-all.sh: npm publish with safe checks (skip if version
  exists on registry, OTP prompt for 2FA accounts, NPM_TOKEN for CI)

═══ Marketing claims cleaned ═══
- Removed unverifiable stats from landing.tsx Stats section
  (50K reviews / 99.2% / 500+ teams) → verifiable facts only
  (31 modules / 7 surfaces / 5 AI providers / BYO LLM)
- Removed JSON-LD aggregateRating (4.8 / 150 reviews — fabricated)
- Replaced 3 fictitious testimonials with non-attributed value props
- Removed bogus social handle (@devmind_ai) and sameAs URLs

═══ Legal / GDPR (this PR's headline addition) ═══
- /privacy: Privacy Policy aligned to GDPR Art. 13/14, specific to
  DevMind's actual practices (multi-tenant isolation, BYOK LLM, Qdrant
  per-tenant collections, AES-256-GCM secret encryption)
- /terms: Terms of Service covering plans, acceptable use, IP ownership
  (Customer Content stays yours, AI output is suggestions not facts),
  liability limits, governing law (Vietnam)
- /cookies: full inventory of cookies + localStorage entries with
  versioned consent storage; revoke control inline
- CookieBanner component: GDPR ePrivacy compliant (equally weighted
  Accept/Necessary buttons, dismissible only via choice, ARIA live region,
  SSR-safe mounting)
- lib/cookie-consent.ts helper with category-gated canUseCategory()
  for future analytics opt-in
- LegalLayout component for consistent typography across all 3 legal pages
- Footer in landing.tsx + MarketingLayout updated with real /privacy
  /terms /cookies links (no more href="#")

═══ Production hardening ═══
- 3 publishable packages now ship LICENSE (MIT) + CHANGELOG.md +
  README.md (root LICENSE is proprietary; client packages MIT)
- Per-app CHANGELOG.md for cli, mcp-server, test-reporter, vscode-extension
- .dockerignore (saves multi-GB build context)
- CI workflow: type-check job per app (api/web/cli/mcp/vscode/browser);
  lint alone wasn't catching tsc errors
- Browser extension manifest cleaned: removed *.aladintech.co +
  localhost:4000 from host_permissions (would fail Chrome Web Store
  review); moved to optional_host_permissions for self-hosters
- 4 broken anchor links fixed (added id="scoring", "flaky", "scheduled",
  "providers" to target sections)
- Replaced fake gitlab.aladintech.co URLs in CLI/VSCode/browser install
  instructions with github.com/devmind-ai/devmind.git generic placeholder

═══ Setup scripts + new npm scripts ═══
- pnpm setup: install + build:shared + db:generate (one-shot bootstrap)
- pnpm release:vsix / release:vsix:vscode / release:vsix:browser
- pnpm publish:all / publish:all:dry

Type-check sạch on all client apps. 2 pre-existing errors in
apps/web/src/stores/__tests__/auth.store.test.ts are from commit 9a683bf7
(UserRole.OWNER no longer exists) and unrelated to this work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>