feat: add Usage Policy page

[acoshift]

What

Adds a public Usage Policy (Acceptable Use Policy) page at /usage-policy, plus a footer link beside "Privacy policy".

• New content/usage-policy/index.md — renders through the existing single.html "Legal" template (same as the Privacy Policy: Ink page-hero + .prose article).
• Footer "Company" column now lists Usage policy above Privacy policy.
• Frontmatter sets a real title so the browser tab / OG title isn't blank (the page header: still drives the <h1>).

Why

The platform had no acceptable-use terms anywhere. This document defines what customers may and may not run on a shared Kubernetes PaaS, our enforcement rights, and customer responsibility for their own apps and end users. It is scoped as an Acceptable Use Policy — it supplements, and does not replace, the Privacy Policy and a future Terms of Service.

A short, plain-language summary that links here is being added to the console separately.

Screenshots

Light	Dark

Policy highlights

• Lines drawn around intent and harm, not blanket bans on normal dev tooling (security tools, crawlers, proxies are explicitly allowed against systems you own).
• Prohibited-use catalogue: mining, DoS/amplification, scanning, malware/C2, stalkerware, abusive relays (public Tor exit nodes disallowed; private VPN / good-faith Tor bridge allowed), spam/mail abuse, telephony fraud, phishing, sybil farms, synthetic-media abuse.
• Illegal-content section with zero-tolerance CSAM handling, IP/piracy takedown-on-notice, and Thailand-specific framing (Computer Crime Act B.E. 2550, PDPA, court/regulator orders).
• Feature-specific rules (registry, custom domains/CDN, disks, invite-only email, service accounts/API keys, internal TCP services), fair-use & billing integrity, a security-research safe harbour, data-protection roles (customer = controller, Moon Rhythm = processor), and graded enforcement.

Notes / judgment calls

• Age threshold pinned to 20 to match the Privacy Policy.
• References to a Terms of Service are written as soft pointers ("where published") since none exists in the repo yet.
• The Privacy Policy references a "Data Protection Officer" it never names — worth reconciling in a follow-up so the two docs stay consistent.

Built locally with hugo --gc --minify (6 pages, clean).

[deploys-app]

Preview deleted (PR closed).