Contact email: newest choice wins by rev, removal wipes the local log

Review follow-ups:
- Each contact_consent event carries a rev that goes up with every change,
  sends are serialized, and `contacts` picks every field from the highest
  rev per copy, so a withdrawal can't lose to an earlier event sent in the
  same second or with a skewed clock.
- Removing the address also replaces it with <removed> in the local
  sent log (earlier contact events and problem reports).
- The prompt is rechecked when the Frame connects, not only at page load.
- No thanks hides the bar only once the dismissal is saved.
- docs/privacy.md: say that the analytics switches don't block a report or
  contact change the person sends deliberately.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/frame_report.py

@@ -158,12 +158,15 @@ def _yes(v):
 def contacts():
     """{'updates': [(email, since)], 'followup': [...]}: the addresses whose newest
     contact_consent event agrees to each, oldest first. A withdrawal, or a change to another
-    address, replaces what came before, so withdrawn addresses are never listed."""
+    address, replaces what came before, so withdrawn addresses are never listed. "Newest" is
+    the highest rev from that copy (then time), so every field comes from the same event
+    whatever order they arrived in or what the clocks said."""
     import frame_compat_db
+    newest = "tuple(ifNull(toInt(properties.rev), 0), timestamp)"
     res = frame_compat_db._posthog_query(
-        "SELECT distinct_id, argMax(properties.email, timestamp), argMax(properties.updates, timestamp), "
-        "argMax(properties.followup, timestamp), max(timestamp) FROM events WHERE event = 'contact_consent' "
-        "GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
+        f"SELECT distinct_id, argMax(properties.email, {newest}), argMax(properties.updates, {newest}), "
+        f"argMax(properties.followup, {newest}), argMax(timestamp, {newest}) FROM events "
+        "WHERE event = 'contact_consent' GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
     out = {'updates': [], 'followup': []}
     for row in res.get('results') or []:
         if not isinstance(row, list) or len(row) != 5: