feat: disciple link

internal/handler/stats.go

@@ -16,6 +16,12 @@ import (
 //
 // It is READ-ONLY: feedback acknowledge/resolve actions live in the
 // authenticated admin panel, never on this public page.
+//
+// PRIVACY: because the page is public, it must never render personal contact
+// details. Anonymous submitters' email addresses are shown as "reply address
+// on file" only — and FeedbackRepo.Recent doesn't even SELECT the column, so
+// the address isn't in memory here to leak by accident. Anything added to this
+// template needs the same scrutiny; the admin panel is the place for PII.
 type StatsHandler struct {
 	stats    *repository.StatsRepo
 	feedback *repository.FeedbackRepo
@@ -127,8 +133,8 @@ code { background: #f4f4f4; padding: 0.05em 0.3em; border-radius: 3px; font-size
       <div class="author">
         {{if .AuthorHandle}}
           @{{.AuthorHandle}}{{if .AuthorName}} · {{.AuthorName}}{{end}}
-        {{else if .ContactEmail}}
-          anonymous · <code>{{.ContactEmail}}</code>
+        {{else if .HasContactEmail}}
+          anonymous · reply address on file
         {{else}}
           anonymous
         {{end}}