Add legal pages, search basics and trust signals

You are my web developer and careful content writer. My store "Thread & Needle" is a fashion e-commerce store at threadandneedle.com that sells women's and men's clothing, shoes and accessories to customers mainly in United States and charges in USD. Payments go through Stripe. I am not a programmer or a lawyer.

Important: you are not a lawyer. Write all policy pages as DRAFTS and say so at the top of each file. At the end, tell me clearly to have them reviewed by a qualified person for United States (and for any country I sell to) before I take real orders. Never invent facts: where a detail is missing (business name, address, return window, shipping times), ask me, or leave a visible placeholder like [YOUR RETURN WINDOW].

Plan first: show me your plan and wait for my OK before changing anything.

Tasks, on a new git branch:
1. Ask me for my real business details and policies, then draft these pages in plain language: Privacy Policy (what data we collect: account, orders, addresses, email; who processes it: the payment gateway, email service, hosting, image service, database; how long we keep it; how a customer asks for access or deletion), Terms of Sale, Returns and Refunds, Shipping, Cookie Notice, and a Contact page with a simple validated form that emails me through Resend (with spam protection and rate limiting) and shows my email address as a fallback.
2. Link all of them in the site footer, and add a required but unticked checkbox at checkout and sign-up: "I agree to the Terms and the Privacy Policy" with links. Store the time of agreement on the order.
3. Cookie and analytics consent: build a small banner with Accept and Reject buttons of equal prominence, and a link in the footer to change the choice later. Strictly necessary cookies (login, cart) work without consent. Any analytics script must load only after Accept. Ask me which analytics tool I want, or use none for now.
4. Search basics: add a sitemap listing the home page, categories, products and policy pages, and a robots file that allows public pages and blocks the admin, cart, checkout and account areas. Add a unique title and description and an Open Graph image to every public page, and mark private pages as noindex.
5. Product structured data: add JSON-LD of type Product on every product page with name, image, description, price, currency, and availability taken from real stock. Output it safely so no product text can break out of the script tag.
6. Trust signals: a clear footer with business name and contact details, secure checkout wording that does not claim anything untrue, visible shipping and returns summary on product pages, and no fake reviews, fake badges or invented counters.

Security rules: no secrets in code or logs; validate the contact form with Zod; escape all user text; do not store card data anywhere.

Verify yourself: run lint, the build and tests; fetch the sitemap and robots output and show them; show the JSON-LD for one product; prove that with consent rejected no analytics request or cookie is created, and that it loads after Accept.

Commit with a clear message such as "Add policy pages, consent banner, sitemap, robots and product structured data" and open a pull request.

Report back in this format:
- What was done
- What I should check (and a reminder to get the policies reviewed for United States)
- Anything that needs my decision

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.