feat(privacy): surface the customer-data scan above the hardware report

- Move the "Customer data" panel to the top of the data section (above the
  chart iframe); header + customer guess always visible, findings table
  collapsed by default and expandable.
- Add a chart top-notice (above Board/CPUs) summarizing the scan via the
  viewer's standard NoticeTitle/NoticeBody - interim until chart custom panels.
- Allowlist ieisystem.com (IEI = Inspur brand infrastructure).
- Add chart-custom-panels-spec.md: a reusable, versioned contract proposal for
  host-supplied panels across every app embedding reanimator/chart.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/static/js/app.js

@@ -1484,16 +1484,30 @@ async function loadPrivacyScan() {
         rows.appendChild(tr);
     }
 
+    const findingsBox = document.getElementById('privacy-findings');
+    const toggle = document.getElementById('privacy-toggle');
+    if (findings.length === 0) {
+        if (findingsBox) findingsBox.style.display = 'none';
+        if (toggle) toggle.style.visibility = 'hidden';
+    } else {
+        if (toggle) {
+            toggle.style.visibility = '';
+            toggle.textContent = privacyCollapsed ? '▼' : '▲';
+        }
+        if (findingsBox) findingsBox.style.display = privacyCollapsed ? 'none' : '';
+    }
+
     section.classList.remove('hidden');
 }
 
-let privacyCollapsed = false;
+// The header + customer summary stay visible; only the findings table collapses.
+let privacyCollapsed = true;
 function togglePrivacy() {
-    const body   = document.getElementById('privacy-body');
+    const box    = document.getElementById('privacy-findings');
     const toggle = document.getElementById('privacy-toggle');
-    if (!body) return;
+    if (!box || !document.getElementById('privacy-rows').children.length) return;
     privacyCollapsed = !privacyCollapsed;
-    body.style.display = privacyCollapsed ? 'none' : '';
+    box.style.display = privacyCollapsed ? 'none' : '';
     toggle.textContent = privacyCollapsed ? '▼' : '▲';
 }
 
@@ -1621,11 +1635,11 @@ async function clearData() {
         if (privacyRows) privacyRows.innerHTML = '';
         const privacyCustomer = document.getElementById('privacy-customer');
         if (privacyCustomer) privacyCustomer.innerHTML = '';
-        privacyCollapsed = false;
-        const privacyBody = document.getElementById('privacy-body');
-        if (privacyBody) privacyBody.style.display = '';
+        privacyCollapsed = true;
+        const privacyFindings = document.getElementById('privacy-findings');
+        if (privacyFindings) privacyFindings.style.display = 'none';
         const privacyToggle = document.getElementById('privacy-toggle');
-        if (privacyToggle) privacyToggle.textContent = '▲';
+        if (privacyToggle) { privacyToggle.textContent = '▼'; privacyToggle.style.visibility = ''; }
     } catch (err) {
         console.error('Failed to clear data:', err);
     }