fix(privacy-banner): gate test hook on webdriver, align doc with sticky behavior

Two follow-ups from Qodo's second review on #7549.

Rule violation: __etherpad_privacyBanner__ was published on every pad
load even when privacyBanner.enabled was false, so the disabled-by-
default feature still added an observable global. Gate the assignment
on `navigator.webdriver` — Playwright/ChromeDriver/Selenium set this
to true; production browsers do not — so the hook is only present for
tests and the disabled path is genuinely zero-side-effect.

Bug 3 (sticky still closable): doc/privacy.md previously claimed
`dismissal: "sticky"` removes the close button, but the gritter
implementation always renders (X). Aligning the doc with reality —
sticky now means "shows on every load, but closable for the session"
— rather than adding bespoke CSS to a vanilla gritter (matches the
"don't style it differently than other gritter messages" preference
that drove the gritter migration in 906e145).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

doc/privacy.md

@@ -76,8 +76,21 @@ policy, contact for erasure requests, etc.
 }
 ```
 
-The banner is rendered from plain text (HTML is escaped) with one
-paragraph per line. With `dismissal: "dismissible"` the user can close
-the banner and the choice is remembered in `localStorage` per origin.
-`dismissal: "sticky"` removes the close button so the notice is shown
-on every pad load.
+The banner is rendered as a persistent gritter notification at the
+bottom of the page (it inherits the same look as every other gritter
+on the pad — no custom skin needed). The body is plain text (HTML is
+escaped); each line becomes its own paragraph.
+
+`dismissal` controls how the close (×) is handled:
+
+- `"dismissible"` (default) — when the user closes the gritter, the
+  choice is persisted in `localStorage` per origin and the banner is
+  not shown again on subsequent pad loads.
+- `"sticky"` — closing the gritter only hides it for the current
+  session; the next pad load shows it again. (The close control is
+  not removed; for an operator-enforced non-closable notice, render
+  the policy out-of-band — e.g., a skin override or a reverse-proxy
+  ribbon.)
+
+Unknown `dismissal` values are coerced to `"dismissible"` with a
+`logger.warn` at settings load.

src/static/js/privacy_banner.ts

@@ -98,6 +98,9 @@ export const showPrivacyBannerIfEnabled = (config: BannerConfig | undefined) =>
 // the Playwright spec at src/tests/frontend-new/specs/privacy_banner.spec.ts
 // has no other way to reach into the real showPrivacyBannerIfEnabled — without
 // this it can only toy with the DOM and never proves the config-to-DOM wiring.
-// Namespaced under __etherpad_privacyBanner__ so it can't collide with site
-// code.
-(globalThis as any).__etherpad_privacyBanner__ = {show: showPrivacyBannerIfEnabled};
+// Gated on navigator.webdriver so the global is invisible in real browsers
+// (Playwright/ChromeDriver/Selenium set webdriver=true; humans don't), keeping
+// the disabled-by-default feature genuinely zero-side-effect in production.
+if (typeof navigator !== 'undefined' && (navigator as any).webdriver) {
+  (globalThis as any).__etherpad_privacyBanner__ = {show: showPrivacyBannerIfEnabled};
+}