Aggiunge heatmaps first-party (click/scroll) con pagina admin Analytics.

Raccoglie eventi aggregati dietro consenso cookie, senza PII né tracking su admin/regia/live/replay; GA4 resta invariato.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/config/locales/legal.en.yml

@@ -88,7 +88,7 @@ en:
       s10_title: 10. Security
       s10_body: "We adopt appropriate technical and organisational measures (authenticated access, encrypted passwords, HTTPS communications, environment segregation, restricted staff access). No system is invulnerable: if you suspect unauthorised access, change your password and contact us."
       s11_title: 11. Cookies and similar technologies
-      s11_p1_html: "The site uses necessary technical cookies (login session, security, storage of cookie preferences) and, subject to consent via the banner, <strong>Google Analytics</strong> for aggregated statistics."
+      s11_p1_html: "The site uses necessary technical cookies (login session, security, storage of cookie preferences) and, subject to consent via the banner, <strong>Google Analytics</strong> and <strong>first-party aggregated statistics</strong> (click/scroll heatmaps) to improve the product."
       s11_p2_html: "You can manage your preferences at any time via the “Manage cookies” link in the footer or consult the %{cookie_policy_link}."
       s11_cookie_policy_link_text: Cookie policy
       s12_title: 12. Changes
@@ -169,7 +169,7 @@ en:
       s4_1_row2_duration: 12 months
       s4_1_row2_provider: Match Live TV (first-party)
       s4_2_title: 4.2 Analytics (only with your consent)
-      s4_2_p1_html: "If you accept “All cookies” or enable statistics in the banner, we load <strong>Google Analytics 4</strong> to understand how the site is used (pages visited, aggregated origin, device). Data is processed by Google Ireland Limited / Google LLC in accordance with their policies."
+      s4_2_p1_html: "If you accept “All cookies” or enable statistics in the banner, we load <strong>Google Analytics 4</strong> to understand how the site is used (pages visited, aggregated origin, device). Data is processed by Google Ireland Limited / Google LLC in accordance with their policies. With the same consent we also collect <strong>first-party aggregated statistics</strong> (clicks and scroll depth, without identifying the user) for internal heatmaps used to improve the product and platform marketing. We do not track the admin area, control room, live player or replay pages."
       s4_2_active_html: "Measurement ID active on the site: <code>%{id}</code>"
       s4_2_inactive: Google Analytics is only configured when the controller sets the measurement ID on the server.
       table2_col_name: Name
@@ -185,6 +185,10 @@ en:
       s4_2_row3_purpose: Distinguishes users (statistics)
       s4_2_row3_duration: 24 hours
       s4_2_row3_provider: Google
+      s4_2_row4_name_html: "Heatmap / scroll (first-party)"
+      s4_2_row4_purpose: Aggregated click and scroll-depth counts by page and device type (no user identifiers)
+      s4_2_row4_duration: Aggregates kept up to 30 days
+      s4_2_row4_provider: Match Live TV (first-party)
       s4_2_p2_html: "You can withdraw consent from the banner or from your browser settings. Google information: %{google_privacy_link}, %{google_optout_link}."
       s4_2_google_privacy_link_text: Google Privacy Policy
       s4_2_google_optout_link_text: Analytics opt-out add-on