Signed-out guests use the fameo_dns cookie

Without a session, opt-out is stored on fameo_dns for one year. No account row is invented.

Guests who submit Do Not Sell set the fameo_dns cookie (value 1, max-age one year). Kumir does not create a User just to store the choice.

Clearing cookies clears the guest signal. Sign in and opt out again to persist User.doNotSellAt.