feat: One Empire initial setup — privacy/terms pages, Instagram OAuth…

[clquek67]

…, token refresh

Adds all assets needed to unblock Meta App Review and expand platform coverage:

main-site/

• privacy.html — Privacy Policy page (one-empire.com/privacy)
• terms.html — Terms of Service page (one-empire.com/terms)
  Styled with One Empire branding (Rajdhani + DM Sans, navy/gold palette).
  Required by Meta before submitting One Empire Social for App Review.

netlify/

• instagram-callback.html — OAuth redirect handler for Instagram Exchanges code via n8n webhook, shows branded success/error state.
• _redirects — adds /instagram/callback route (alongside existing LinkedIn + Facebook)

supabase/

• instagram_tokens.sql — creates instagram_tokens table with RLS, stores long-lived tokens (60d), username, page linkage, expiry timestamps.

n8n/

• instagram-oauth.json — "One Empire — Instagram OAuth Token Exchange" workflow Webhook → ack → exchange short-lived code → long-lived token (60d) → upsert Supabase. Uses $env.INSTAGRAM_APP_SECRET; no getCredentials().
• token-refresh.json — "One Empire — Token Refresh Scheduler" workflow Runs daily. LinkedIn: flags expiring/expired tokens (no silent refresh possible). Facebook + Instagram: auto-refreshes tokens expiring within 14 days via Graph API, patches Supabase records, compiles a report with any action-required alerts.

https://claude.ai/code/session_01E6oiiLBmmwRJgeMMUWZpGT