fix(ui): PR-P G-04 + G-05 + G-28 — /consent page, drop SK leak, all building chips

G-05 — extract Slovak strings from /o-platforme.
The page imports `dictFor(lang).aboutPage` for most copy but 7 strings
were still hardcoded in Slovak (Vďaka, Vstupná, Heslá, Claude … 3×
preklad, žiadne PNG, sú vektor, Späť, súkromia). Visible to PL/UK/CS/EN
players as a 7-string Slovak leak. Five became new aboutPage keys
(`techNoteZod`, `techNoteAuth`, `techNoteSdk`, `techSvgName`,
`techSvgNote`); the thanks line + 2 footer links reuse pre-existing
`sponsorsThanks`, `footerHome`, `footerPrivacy` keys (avoided
introducing duplicates).

G-04 — `/consent` informational page (NEW).
Cookie banner's "More" CTA used to deep-link straight into the long
privacy policy. We ship exactly 3 strictly-necessary cookies
(xp-session, wc_csrf, xp_lang), no analytics, no tracking — so the
right surface is a focused page that lists them with purpose +
lifetime. Privacy policy stays the secondary deep-link from /consent.

Server component, per-locale via `getLang()`. New `consent.*` dict
keys × 4 langs. Banner "More / Více" link on desktop now points
at /consent via `<Link>` (next/link required by ESLint
@next/next/no-html-link-for-pages); mobile inline link kept on
/ochrana-sukromia per banner-tightness pattern.

G-28 — CityLevelCard show all building groups.
User feedback (screenshot 0:15:46): "Twoje budynki" strip clamped at
6 chips via `aggregateByCatalog(...).slice(0, 6)`. Player with > 6
distinct catalog types couldn't see the rest. Removed the slice —
catalog ceiling (~30 entries) is the natural upper bound, parent
flex-wrap handles overflow into multiple rows.

Tooling note: initial uk/pl/cs intro strings used German low-9 +
straight-quote inner labels („Akceptuj") which TS parsed as
mid-string termination. Replaced inner decorative quotes with
context-only label words (no quotes) so all 4 locales compile clean.

Validation:
- pnpm typecheck → 0 errors
- pnpm lint → 0 errors

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: B2JK-Industry

app/consent/page.tsx

@@ -0,0 +1,62 @@
+import Link from "next/link";
+import { dictFor } from "@/lib/i18n";
+import { getLang } from "@/lib/i18n-server";
+
+/* G-04 — informational `/consent` page.
+ *
+ * cookie-consent.tsx (`Více / More` link) used to point at
+ * /ochrana-sukromia (the long privacy policy). After the banner
+ * audit confirmed we ship exactly 3 strictly-necessary cookies and
+ * no analytics/tracking, the right surface for the "More" CTA is a
+ * focused informational page that lists those 3 cookies + their
+ * purpose + lifetime. Privacy policy stays the secondary deep-link.
+ */
+export default async function ConsentPage() {
+  const lang = await getLang();
+  const t = dictFor(lang).consent;
+  const cookies = [
+    {
+      name: "xp-session",
+      purpose: t.cookieSessionPurpose,
+      duration: t.cookieDurationSession,
+    },
+    {
+      name: "wc_csrf",
+      purpose: t.cookieCsrfPurpose,
+      duration: t.cookieDurationSession,
+    },
+    {
+      name: "xp_lang",
+      purpose: t.cookieLangPurpose,
+      duration: t.cookieDuration1y,
+    },
+  ];
+  return (
+    <main className="max-w-2xl mx-auto card p-6 flex flex-col gap-4 animate-slide-up">
+      <h1 className="t-h2 text-[var(--accent)]">{t.title}</h1>
+      <p className="text-[var(--ink-muted)]">{t.intro}</p>
+      <table className="w-full text-sm">
+        <thead className="text-xs text-[var(--ink-muted)] border-b border-[var(--line)]">
+          <tr>
+            <th className="text-left p-2">{t.colName}</th>
+            <th className="text-left p-2">{t.colPurpose}</th>
+            <th className="text-left p-2">{t.colDuration}</th>
+          </tr>
+        </thead>
+        <tbody>
+          {cookies.map((c) => (
+            <tr key={c.name} className="border-b border-[var(--line)]">
+              <td className="p-2 font-mono">{c.name}</td>
+              <td className="p-2">{c.purpose}</td>
+              <td className="p-2 text-[var(--ink-muted)]">{c.duration}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+      <p className="t-caption text-[var(--ink-muted)]">{t.optOutBody}</p>
+      <Link href="/ochrana-sukromia" className="btn btn-secondary self-start">
+        {t.privacyPolicy}
+      </Link>
+    </main>
+  );
+}

app/o-platforme/page.tsx

@@ -283,10 +283,7 @@ export default async function AboutPage() {
               /ochrana-sukromia
             </Link>
           </p>
-          <p className="text-xs text-[var(--ink-muted)]">
-            Vďaka: PKO Bank Polski · Tauron · ETHWarsaw · AKMF ·
-            Katowicki.Hub.
-          </p>
+          <p className="text-xs text-[var(--ink-muted)]">{t.sponsorsThanks}</p>
         </div>
       </section>
 
@@ -389,11 +386,11 @@ export default async function AboutPage() {
           <TechItem name="TypeScript strict" note="Úplné typové pokrytie." />
           <TechItem name="Tailwind CSS 4" note="Neo-brutalist tokens + primitives v globals.css." />
           <TechItem name="Upstash Redis" note="Sorted sets pre leaderboardy, JSON pre účty a duely, EU región." />
-          <TechItem name="zod" note="Vstupná + AI-output validácia." />
-          <TechItem name="scrypt + HMAC" note="Heslá + HTTP-only signed session cookie." />
+          <TechItem name="zod" note={t.techNoteZod} />
+          <TechItem name="scrypt + HMAC" note={t.techNoteAuth} />
           <TechItem name="Vercel Cron" note="AI pipeline trigger denne o 09:00 UTC." />
-          <TechItem name="Anthropic SDK" note="Claude Sonnet 4.6 (PL gen) + Haiku 4.5 (3× preklad), JSON structured output." />
-          <TechItem name="SVG, žiadne PNG/JPG" note="Celé mestečko + budova sú vektor, ostrý na 4K." />
+          <TechItem name="Anthropic SDK" note={t.techNoteSdk} />
+          <TechItem name={t.techSvgName} note={t.techSvgNote} />
         </div>
       </section>
 
@@ -449,8 +446,8 @@ export default async function AboutPage() {
       </section>
 
       <footer className="text-xs text-[var(--ink-muted)] border-t border-[var(--line)] pt-4 flex flex-wrap gap-4">
-        <Link href="/" className="underline">Späť na domov</Link>
-        <Link href="/ochrana-sukromia" className="underline">Ochrana súkromia</Link>
+        <Link href="/" className="underline">{t.footerHome}</Link>
+        <Link href="/ochrana-sukromia" className="underline">{t.footerPrivacy}</Link>
         <a
           href="https://github.com/B2JK-Industry/watt-city"
           className="underline"

components/city-level-card.tsx

@@ -104,8 +104,13 @@ type Props = {
 
 /** Aggregate the player's buildings by catalog id so a city of "3 Domek
  *  + 2 Sklepik" renders as two chips (🏠 ×3, 🏪 ×2) instead of five
- *  identical glyphs. Returns up to 6 chips ordered by descending count
- *  (most-built first) so the strip reads as "what defines this city". */
+ *  identical glyphs. Returns ALL distinct building groups ordered by
+ *  descending count (most-built first) so the strip reads as
+ *  "everything you've built so far" — flex-wrap on the parent
+ *  handles overflow into multiple rows.
+ *  G-28 — previously clamped at 6; user reported missing buildings
+ *  on cities with >6 distinct types. The catalog ceiling (~30
+ *  entries) is the natural upper bound now. */
 function aggregateByCatalog(
   buildings: ReadonlyArray<{ catalogId: string; level: number }>,
 ): Array<{ glyph: string; name: string; count: number; topLevel: number }> {
@@ -129,9 +134,7 @@ function aggregateByCatalog(
       });
     }
   }
-  return Array.from(groups.values())
-    .sort((a, b) => b.count - a.count)
-    .slice(0, 6);
+  return Array.from(groups.values()).sort((a, b) => b.count - a.count);
 }
 
 export function CityLevelCard({ player, lang }: Props) {

components/cookie-consent.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
+import Link from "next/link";
 import { usePathname } from "next/navigation";
 import type { Lang } from "@/lib/i18n";
 
@@ -197,12 +198,17 @@ export function CookieConsent({
           <span>✓ {copy.noAds}</span>
         </p>
       </div>
-      <a
-        href="/ochrana-sukromia"
+      {/* G-04 — desktop "more" CTA points at the focused informational
+          /consent page (cookie list + 1-line privacy policy link). The
+          long policy lives at /ochrana-sukromia and is reachable from
+          /consent; mobile inline link still goes there directly to
+          keep the banner tight. */}
+      <Link
+        href="/consent"
         className="hidden sm:inline-flex btn btn-ghost btn-sm shrink-0"
       >
         {copy.more}
-      </a>
+      </Link>
       <button
         type="button"
         onClick={ack}

lib/locales/cs.ts

@@ -1,6 +1,22 @@
 import type plDict from "./pl";
 
 const cs: typeof plDict = {
+  consent: {
+    title: "Cookies ve Watt City",
+    intro:
+      "Používáme pouze 3 cookies — všechny nezbytné pro chod aplikace. Nesbíráme žádná analytická ani reklamová data, proto má banner jen jedno tlačítko Přijmout.",
+    colName: "Název",
+    colPurpose: "Účel",
+    colDuration: "Životnost",
+    cookieSessionPurpose: "Relace přihlášeného uživatele (HTTP-only, signed).",
+    cookieCsrfPurpose: "CSRF token chránící formuláře.",
+    cookieLangPurpose: "Zvolený jazyk rozhraní.",
+    cookieDurationSession: "Relace",
+    cookieDuration1y: "1 rok",
+    optOutBody:
+      "Tyto 3 cookies nelze vypnout — bez nich aplikace nepoběží (přihlášení, ochrana formulářů, jazyk). Úplné zásady ochrany soukromí níže.",
+    privacyPolicy: "Zásady ochrany soukromí",
+  },
   errors: {
     title: "Něco se pokazilo",
     body: "Nepodařilo se načíst stránku. Zkus to znovu — tvá data jsou v bezpečí.",
@@ -430,6 +446,11 @@ const cs: typeof plDict = {
   },
   aboutPage: {
     title: "O platformě",
+    techNoteZod: "Validace vstupů + AI outputu.",
+    techNoteAuth: "Hesla + HTTP-only signed session cookie.",
+    techNoteSdk: "Claude Sonnet 4.6 (gen PL) + Haiku 4.5 (3× překlad), JSON structured output.",
+    techSvgName: "SVG, žádné PNG/JPG",
+    techSvgNote: "Celé městečko + budovy jsou vektor, ostré na 4K.",
     ideaTitle: "Myšlenka projektu",
     scienceTitle: "Věda za návykem — proč efemerní hry",
     howTitle: "Jak to funguje",

lib/locales/en.ts

@@ -1,6 +1,22 @@
 import type plDict from "./pl";
 
 const en: typeof plDict = {
+  consent: {
+    title: "Cookies in Watt City",
+    intro:
+      "We use exactly 3 cookies — all strictly necessary for the app to work. No analytics, no advertising, no tracking — so the banner has a single \"Accept\" button.",
+    colName: "Name",
+    colPurpose: "Purpose",
+    colDuration: "Lifetime",
+    cookieSessionPurpose: "Authenticated user session (HTTP-only, signed).",
+    cookieCsrfPurpose: "CSRF token protecting forms.",
+    cookieLangPurpose: "Chosen interface language.",
+    cookieDurationSession: "Session",
+    cookieDuration1y: "1 year",
+    optOutBody:
+      "These 3 cookies can't be turned off — without them the app won't work (login, form protection, language). Full privacy policy below.",
+    privacyPolicy: "Privacy policy",
+  },
   errors: {
     title: "Something went wrong",
     body: "We couldn't load this page. Try again — your data is safe.",
@@ -430,6 +446,11 @@ const en: typeof plDict = {
   },
   aboutPage: {
     title: "About",
+    techNoteZod: "Input + AI-output validation.",
+    techNoteAuth: "Passwords + HTTP-only signed session cookie.",
+    techNoteSdk: "Claude Sonnet 4.6 (PL gen) + Haiku 4.5 (3× translation), JSON structured output.",
+    techSvgName: "SVG, no PNG/JPG",
+    techSvgNote: "Entire city + buildings are vector — sharp on 4K.",
     ideaTitle: "Project idea",
     scienceTitle: "The science behind the habit — why ephemeral games",
     howTitle: "How it works",

lib/locales/pl.ts

@@ -1,4 +1,20 @@
 const pl = {
+  consent: {
+    title: "Cookies w Watt City",
+    intro:
+      "Używamy wyłącznie 3 plików cookie, wszystkie ściśle niezbędne do działania aplikacji. Nie zbieramy żadnych danych analitycznych ani reklamowych — dlatego banner ma tylko jeden przycisk Akceptuj.",
+    colName: "Nazwa",
+    colPurpose: "Cel",
+    colDuration: "Czas życia",
+    cookieSessionPurpose: "Sesja zalogowanego użytkownika (HTTP-only, signed).",
+    cookieCsrfPurpose: "Token CSRF chroniący formularze.",
+    cookieLangPurpose: "Wybrany język interfejsu.",
+    cookieDurationSession: "Sesja",
+    cookieDuration1y: "1 rok",
+    optOutBody:
+      "Te 3 cookie nie da się wyłączyć — bez nich aplikacja nie zadziała (logowanie, ochrona formularzy, język). Pełna polityka prywatności poniżej.",
+    privacyPolicy: "Polityka prywatności",
+  },
   errors: {
     title: "Coś poszło nie tak",
     body: "Nie udało się wczytać strony. Spróbuj ponownie — Twoje dane są bezpieczne.",
@@ -428,6 +444,11 @@ const pl = {
   },
   aboutPage: {
     title: "O platformie",
+    techNoteZod: "Walidacja wejść + outputu AI.",
+    techNoteAuth: "Hasła + HTTP-only signed session cookie.",
+    techNoteSdk: "Claude Sonnet 4.6 (gen PL) + Haiku 4.5 (3× tłumaczenie), JSON structured output.",
+    techSvgName: "SVG, żadnych PNG/JPG",
+    techSvgNote: "Całe miasteczko + budynki są wektorem, ostre na 4K.",
     ideaTitle: "Idea projektu",
     scienceTitle: "Nauka za nawykiem — dlaczego efemeryczne gry",
     howTitle: "Jak to działa",

lib/locales/uk.ts

@@ -1,6 +1,22 @@
 import type plDict from "./pl";
 
 const uk: typeof plDict = {
+  consent: {
+    title: "Cookies у Watt City",
+    intro:
+      "Використовуємо лише 3 cookies — усі необхідні для роботи застосунку. Не збираємо аналітики чи реклами, тому банер має лише кнопку Прийняти.",
+    colName: "Назва",
+    colPurpose: "Призначення",
+    colDuration: "Тривалість",
+    cookieSessionPurpose: "Сесія авторизованого користувача (HTTP-only, signed).",
+    cookieCsrfPurpose: "CSRF-токен для захисту форм.",
+    cookieLangPurpose: "Обрана мова інтерфейсу.",
+    cookieDurationSession: "Сесія",
+    cookieDuration1y: "1 рік",
+    optOutBody:
+      "Ці 3 cookies не можна вимкнути — без них застосунок не працюватиме (логін, захист форм, мова). Повна політика приватності нижче.",
+    privacyPolicy: "Політика приватності",
+  },
   errors: {
     title: "Щось пішло не так",
     body: "Не вдалося завантажити сторінку. Спробуй ще раз — твої дані в безпеці.",
@@ -430,6 +446,11 @@ const uk: typeof plDict = {
   },
   aboutPage: {
     title: "Про платформу",
+    techNoteZod: "Валідація вхідних даних + AI-output.",
+    techNoteAuth: "Паролі + HTTP-only signed session cookie.",
+    techNoteSdk: "Claude Sonnet 4.6 (gen PL) + Haiku 4.5 (3× переклад), JSON structured output.",
+    techSvgName: "SVG, ніяких PNG/JPG",
+    techSvgNote: "Усе містечко + будівлі — вектор, чіткі на 4K.",
     ideaTitle: "Ідея проєкту",
     scienceTitle: "Наука за звичкою — чому ефемерні ігри",
     howTitle: "Як це працює",