Publish a no-unsolicited-messages policy

The .xyz registry put the domain on serverHold after SURBL listed it in
its ABUSE list. SURBL only delists a site that links to a published
policy against advertising it by unsolicited messages, and a privacy
policy does not count.

Add the policy at /:locale/policy in all three languages, linked from
the footer and listed in the sitemap, and the same text in the README
so it can be read on GitHub while the domain does not resolve. Reports
go to the asxp.io contact form; the site itself has no email.

Assisted-by: Claude:opus-5-5

views/policy.erb

@@ -0,0 +1,17 @@
+<main>
+  <header>
+    <h1><%= t(:policy_link) %></h1>
+    <nav class="langs">
+      <% Bingo::LOCALES.each do |l| %>
+        <a href="<%= @path_for.(l) %>" hreflang="<%= l %>" lang="<%= l %>" <%== 'aria-current="page"' if l == @locale %>><%= l %></a>
+      <% end %>
+    </nav>
+  </header>
+  <nav class="crumbs"><a href="/<%= @locale %>"><%= t(:back) %></a></nav>
+
+  <% t(:policy_text).each do |para| %>
+    <p class="lead"><%== format(Rack::Utils.escape_html(para), link: '<a href="https://asxp.io/contact">asxp.io/contact</a>') %></p>
+  <% end %>
+
+  <%== erb :_footer, layout: false %>
+</main>