fix: close privacy policy checker consistency gaps

[gbasin]

Summary

• closes PP-002 gap by treating template-literal interpolation in fetch(...) targets as dynamic and non-compliant
• closes PP-003 gap by detecting /api/paste-image routes with either single or double quotes and requiring an explicit write operation
• closes PP-004 gap by validating each individual persist(...) call (not just file-level presence)
• updates runtime fetch usage to static local-relative targets for session preview and directory requests
• adds regression coverage for dynamic template fetch detection, mixed persisted stores in one file, header-based static fetch routes, and double-quoted paste-image route detection

Privacy Checker Scope

• static analysis only: this checker verifies source/dependency consistency with docs/privacy-policy.md claims and does not prove runtime/legal compliance under all environments