build(deploy): assistants.env for the operator's assistants, Caddy forwards /privacy (ADR 0021, step 2)

- deploy/assistants.env.example: every variable commented, with a
  Claude example and a second assistant on the Responses API. The file
  itself is git-ignored and reaches Learn's server alone
  (compose.yaml's env_file, required: false, so an instance without it
  offers no assistant; that syntax needs Docker Compose v2.24 or later).
- deploy/.env.example points to it.
- The Caddyfile forwards /privacy to the web server, as it does
  /simplelogin-callback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/Caddyfile

@@ -1,6 +1,6 @@
 # Caddy forwards to the API server, and profile pages (ADR 0011), the dictionaries
-# devices download (ADR 0012) and SimpleLogin's forwarding page (ADR 0020) to the web
-# server (8082), which serves nothing else. Never the calls between the instance's
+# devices download (ADR 0012), SimpleLogin's forwarding page (ADR 0020) and the
+# privacy page (ADR 0021) to the web server (8082), which serves nothing else. Never the calls between the instance's
 # services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
 # if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
 #
@@ -25,6 +25,13 @@
 		respond 404
 	}
 
+	# The instance's privacy page (Halkyon Learn's ADR 0021, D39), made from its
+	# settings, readable before signing up.
+	@privacy path /privacy
+	handle @privacy {
+		reverse_proxy server:8082
+	}
+
 	# SimpleLogin's forwarding page (ADR 0020): where SimpleLogin sends a sign-in back,
 	# which sends it on to the app that began it, by the loopback or its scheme.
 	@simplelogin path /simplelogin-callback