Grant full consent fallback for non-TCF visitors in bridge mode (v1.3.3)

Visitors outside EEA/UK/CH (e.g. Americas) have no __tcfapi injected by
Google Funding Choices, causing the TCF bridge poll to time out and leaving
them permanently at the default denied state. After the 10s timeout, grant
full consent — GDPR opt-in doesn't apply to these visitors and CCPA is
an opt-out model, so granted is the correct default.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/js/tcf-bridge.js

@@ -91,6 +91,12 @@
 		}
 		elapsed += POLL_INTERVAL;
 		if (elapsed >= MAX_WAIT_MS) {
+			// __tcfapi never appeared: visitor is outside TCF jurisdiction (e.g. Americas)
+			// or the CMP script was blocked. GDPR opt-in doesn't apply; grant full consent
+			// so these visitors aren't silently tracked as denied.
+			try {
+				window.AttConsent.update({ functional: true, analytics: true, marketing: true });
+			} catch (e) {}
 			return;
 		}
 		setTimeout(poll, POLL_INTERVAL);