fix(v2): critical bug fixes — root SSH, bootstrap wait, SG deletion order, PAT masking

- EC2 bootstrap now enables root SSH (copies authorized_keys to root, sets
  PermitRootLogin without-password, reloads sshd) so all commands run as
  root and NVM at /root/.nvm is accessible
- Added /var/lib/pp-bootstrap-done sentinel; deploy waits for it before
  running any user commands — prevents race between SSH availability and
  user-data completion (docker/nvm install can take 3-5+ min)
- Fixed stopPreview: terminate instance first, delete key pair next, then
  delete security group with 30s delay — SG deletion was previously
  attempted before termination causing it to fail
- Fixed redeploy to always fetch fresh instanceIp/sshPrivateKey from DB
  rather than using potentially-stale preview parameter
- Fixed .env writing to use base64 encoding via echo|base64-d to safely
  handle values with special characters, single quotes, and newlines
- PAT and git clone URL now masked in preview logs (shows **** for password)
- Fixed inactivity cron: removed dead inactivityMs variable, use join on
  repoConfig to avoid N+1, deduplicate pending INACTIVITY_STOP jobs
- Fixed IAM policy UI: ec2:CreateKeyPair (backend uses CreateKeyPair, not
  ImportKeyPair which is a different AWS operation)
- Admin panel: added Edit button with username/password form for users
- Privacy page: fetch and display admin contactEmail from settings
- pnpm-workspace.yaml: fix allowBuilds→onlyBuiltDependencies for pnpm 9

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/pages/Privacy.tsx

@@ -1,7 +1,16 @@
-import React from "react";
+import React, { useEffect, useState } from "react";
 import { Link } from "react-router-dom";
+import { api } from "../services/api";
 
 export function Privacy() {
+  const [contactEmail, setContactEmail] = useState<string | null>(null);
+
+  useEffect(() => {
+    api.admin.getSettings().then(res => {
+      if (res.ok && res.data?.contactEmail) setContactEmail(res.data.contactEmail);
+    }).catch(() => {});
+  }, []);
+
   return (
     <div className="max-w-2xl prose dark:prose-invert">
       <Link to="/" className="text-sm text-blue-600 dark:text-blue-400 hover:underline mb-4 inline-block">← Back</Link>
@@ -10,9 +19,9 @@ export function Privacy() {
 
       <h2>What We Store</h2>
       <ul>
-        <li>Your username and hashed password.</li>
-        <li>Your Gitea Personal Access Token (PAT), encrypted at rest with AES-256.</li>
-        <li>Your AWS Access Key ID and Secret Access Key, encrypted at rest with AES-256.</li>
+        <li>Your username and hashed password (bcrypt).</li>
+        <li>Your Gitea Personal Access Token (PAT), encrypted at rest with AES-256-GCM.</li>
+        <li>Your AWS Access Key ID and Secret Access Key, encrypted at rest with AES-256-GCM.</li>
         <li>Preview logs, PR metadata (PR number, title, commit SHA), and EC2 instance details.</li>
         <li>SSH private keys (ephemeral per launch, encrypted at rest, deleted on instance termination).</li>
       </ul>
@@ -26,16 +35,20 @@ export function Privacy() {
       </ul>
 
       <h2>Data Retention</h2>
-      <p>Preview records are retained for the number of days configured by the administrator (default: 30 days after a preview is stopped or failed). You can view this setting in the admin panel.</p>
+      <p>Preview records (logs, metadata) are retained for the number of days configured by the administrator (default: 30 days after a preview is stopped or failed). You can view this setting in the admin panel.</p>
 
       <h2>EC2 Instances</h2>
-      <p>Preview instances are launched in your own AWS account. PP terminates them on PR close, inactivity timeout, or manual stop. PP does not retain any data from inside EC2 instances.</p>
+      <p>Preview instances are launched in your own AWS account using your credentials. PP terminates them on PR close, inactivity timeout, or manual stop. PP does not retain any data from inside EC2 instances beyond what is captured in preview logs.</p>
 
-      <h2>Analytics & Tracking</h2>
+      <h2>Analytics &amp; Tracking</h2>
       <p>No analytics, no tracking, no external data sharing. PP is fully self-contained.</p>
 
       <h2>Contact</h2>
-      <p>For questions or concerns, contact the instance administrator.</p>
+      {contactEmail ? (
+        <p>For questions or concerns, contact the instance administrator at <a href={`mailto:${contactEmail}`} className="text-blue-600 dark:text-blue-400 underline">{contactEmail}</a>.</p>
+      ) : (
+        <p>For questions or concerns, contact the instance administrator.</p>
+      )}
     </div>
   );
 }