KPI and Cookies Consent Banner

[Sundraiz-Shah]

Summary

Implements anonymous visitor tracking, an hourly KPI dashboard, and
full GDPR-compliant cookie consent.

Changes

Visitor Tracking & KPI

• Added SiteStats model to record total requests and unique visitors
  per hour (date + hour as unique key)
• Added TrackingMiddleware to count visits anonymously using Django
  sessions — no IP addresses or personal data stored
• Registered SiteStats in Django Admin with hourly display and
  read-only fields

Cookie Consent

• Added cookie consent banner to base.html with Accept / Decline
• Decline and withdraw consent expire after 10 minutes, after which
  the banner reappears
• Accept saves consent for 1 year
• Banner links to the Legals / Impressum page

GDPR Compliance

• Updated legals.html with full privacy notice including legal basis
  (GDPR Article 6(1)(a)), cookie names, durations, data controller,
  and user rights
• Added withdraw consent option on the legals page
• Session cookie (sessionid) is only created after user gives consent
• CSS and JS fully separated from legals.html — no inline styles or
  scripts

Settings

• Added SESSION_SAVE_EVERY_REQUEST = False to delay session cookie
  until consent is given
• Added SESSION_COOKIE_SAMESITE = Lax for cookie security

Files Changed

• meta_creator/models.py — new SiteStats model
• meta_creator/middleware.py — tracking middleware
• meta_creator/admin.py — admin registration
• meta_creator/templates/meta_creator/legals.html — updated legal page
• static/css/legals.css — legals page styles
• static/foundation/js/vendor/cookie-consent.js — consent + withdraw logic
• static/foundation/js/vendor/legals.js — legals page JS
• static/foundation/js/vendor/init.js — registered cookie consent module
• meta_tool/settings.py — session cookie settings
• templates/base.html — cookie banner

Testing

• Cookie banner appears on first visit
• Accept saves cookie_consent=true for 6 months
• Decline saves cookie_consent=false for 10 minutes
• Withdraw on legals page sets cookie_consent=false for 10 minutes
• Hourly rows appear in Django Admin after accepting and browsing
• No tracking occurs when consent is declined or withdrawn
• sessionid cookie is not set before consent is given