docs: add EU region & data residency page

[stephenvapiai]

Adds a new page: fern/security-and-privacy/eu-region.mdx ("EU region & data residency"), plus its fern/docs.yml navigation entry under Security and privacy, right after Data flow.

Files changed:

• fern/security-and-privacy/eu-region.mdx (new page)
• fern/docs.yml (nav entry)

[stephenvapiai]

Why this gap, and why now

Over the trailing 28 days, 55 distinct customer support tickets/chats asked some version of "how do I get/migrate to an EU-hosted Vapi organization" — spanning Aug 15 through Aug 25 (persistent across every 7-day window checked, not a one-off spike). Representative asks:

• "How do I create an EU-hosted organization / migrate my US org to the EU region?" (repeated across many tickets, e.g. reports of dashboard.eu.vapi.ai having no visible sign-up option, OAuth/Google sign-in looping back to login, or the EU dashboard being reachable but signup redirecting to login)
• "Can my existing assistants, tools, phone numbers, and SIP trunk credentials be migrated from US to EU?"
• GDPR/DPA/data-residency questions tied directly to the EU-org confusion (retention periods, subprocessors, whether the DPA/EU residency documentation applies)
• Several tickets where the bot/agent had to explain case-by-case that "region selection requires contacting Vapi support to migrate the organization" — i.e. support is manually repeating an answer that isn't written down anywhere customer-facing.

Why this beat the higher-raw-volume topics that week: the top two L2 topics by this-week volume ("Operation Completion Performance" and "Uptime & Availability") were sampled and are outage/incident reports (504s, worker-not-available faults, dashboard-down incidents) — real production issues, not documentation gaps, so they were skipped per the editorial sanity check. The EU-region confusion ranked highest among the remaining candidates for volume and is the one where the evidence repeatedly shows customers hitting a dead end and support answering the same question by hand each time.

What existing docs say today (checked before drafting): the one fact that does exist — "Vapi's EU support and self-serve growth are frozen until 2027; new self-serve customers should use the US region; contact Sales for enterprise EU onboarding" — is buried as a single <Warning> callout inside the SIP setup guide (/advanced/sip) and referenced in passing on the Data Flow page. It isn't on the FAQ, isn't linked from account/org setup, and doesn't answer the specific follow-on questions customers keep asking (can an existing org migrate, what happens to existing resources, is there a non-Enterprise path). That's a missing content gap, not just a discoverability one — no single page answers "how do I use/migrate to the EU region," so I drafted one rather than just tweaking the existing SIP note.

Scope of this PR: intentionally limited to the new page + its nav entry (no edits to SIP/Data Flow/FAQ) to keep this change reviewable as one gap = one PR, per the doc-gap workflow.