What Looked Like “Just Polishing My T&Cs” Turned Into a Full-Stack Risk Check