ots privacy section: add 'Bitcoin addresses stay private' claim

OTS doesn't require the user to sign or broadcast a transaction at
all. Calendar operators batch-anchor every submission they receive
into one OP_RETURN and pay the on-chain fee themselves, so the user's
UTXOs and addresses never appear on chain. This is one of OTS's
strongest privacy properties versus inscriptions / runes / stamps,
and it deserves its own card in the shield section.

Grid switches from 3-col (col-md-4) to 2-col on tablet + 4-col on
desktop (col-md-6 col-lg-3) so the four claims fit cleanly across
breakpoints.

Author: hans-crypto

frontend/src/app/components/_ordpool/open-timestamps/open-timestamps.component.html

@@ -178,22 +178,30 @@ <h2 class="mt-3">Your privacy is the point</h2>
     </p>
 
     <div class="row mt-4 text-start">
-      <div class="col-md-4 mb-3">
+      <div class="col-md-6 col-lg-3 mb-3">
         <h5>Your file never leaves your browser</h5>
         <p class="text-muted">
           We compute the 32-byte SHA-256 fingerprint locally. Only the hash
           is ever transmitted. Never the contents, never the filename.
         </p>
       </div>
-      <div class="col-md-4 mb-3">
+      <div class="col-md-6 col-lg-3 mb-3">
+        <h5>Your Bitcoin addresses stay private</h5>
+        <p class="text-muted">
+          You don't sign or broadcast a transaction. Calendar operators
+          batch-anchor everyone's hashes and pay the on-chain fee themselves,
+          so no UTXO or address ever links back to your stamp.
+        </p>
+      </div>
+      <div class="col-md-6 col-lg-3 mb-3">
         <h5>Calendars only see us</h5>
         <p class="text-muted">
           Stamp submissions and confirmation polls both route through our
           backend. The four public calendar operators receive Ordpool's IP,
           not yours, on every request.
         </p>
       </div>
-      <div class="col-md-4 mb-3">
+      <div class="col-md-6 col-lg-3 mb-3">
         <h5>We don't log who you are</h5>
         <p class="text-muted">
           Our backend keeps no per-request user data: no IPs, no hashes,