fix: Secure flag in clearTrackingCookies; improve Google Signals disclosure

- Add Secure flag to clearTrackingCookies() deletion attempts so GA4
  cookies set over HTTPS (which carry Secure) are actually deleted on
  revocation — previously silent failures on HTTPS
- Update Google Signals description to disclose cross-site data use and
  Google account association per GDPR Art. 4(11)/7 informed consent
  requirements

Author: BenjaminMichaelis

EssentialCSharp.Web/wwwroot/js/consent-manager.js

@@ -143,7 +143,7 @@ class ConsentManager {
                         <span class="consent-slider"></span>
                         <div class="consent-info">
                             <strong>Google Signals</strong>
-                            <p>Consent signals passed to Google to support analytics modeling and measurement. No advertisements are served on this site.</p>
+                            <p>Allows Google to associate your visit with your Google account for analytics modeling and cross-site measurement. No advertisements are served on this site, but Google may use this data across its services.</p>
                         </div>
                     </label>
                 </div>
@@ -457,9 +457,10 @@ class ConsentManager {
         const allCookies = [...new Set([...trackingCookies, ...ga4Cookies])];
 
         allCookies.forEach(cookieName => {
-            document.cookie = `${cookieName}=;${expired};path=/`;
+            const secure = window.location.protocol === 'https:' ? ';Secure' : '';
+            document.cookie = `${cookieName}=;${expired};path=/${secure}`;
             domains.forEach(domain => {
-                document.cookie = `${cookieName}=;${expired};path=/;domain=${domain}`;
+                document.cookie = `${cookieName}=;${expired};path=/;domain=${domain}${secure}`;
             });
         });
     }