GDPR export + deletion

[tayebmokni]

Summary

Implement GDPR export and deletion per doc 06 §2.2 ("hard-delete is a separate GDPR pipeline that anonymizes references"). Export: a user can request a downloadable archive of their personal data (profile, posts they authored, comments, media metadata, audit log entries about them). Deletion: a user can request account deletion. Soft-delete is the default (sets users.status='deleted', deleted_at=NOW()); a follow-on GDPR job anonymizes references (replaces authorship with a deleted_user sentinel for retained content). Both flows are admin-mediated for high-privilege users.

Design reference

• docs/06-auth-permissions.md §2.2 (soft-delete vs GDPR hard-delete), §1 (Goals — Revocable + Auditable)

Acceptance criteria

• POST /api/v1/me/gdpr/export enqueues a job that produces a zip (JSON profile + content + media manifest + audit slice) and emails a signed download link (24h expiry)
• POST /api/v1/me/gdpr/delete initiates deletion with a 7-day grace period; emits a confirmation email; cancellable during grace
• After grace: soft-delete the user, anonymize authored content (FK to a deleted_user sentinel), null PII columns; cascade: revoke sessions, PATs, OAuth grants
• Admin override: super_admin can hard-delete immediately with audit reason
• Audit log entries: gdpr.export.requested, gdpr.export.completed, gdpr.delete.requested, gdpr.delete.completed, gdpr.delete.cancelled
• Operator setting: which audit events survive a deletion (some are required by retention policy)
• Worker job idempotent on retry

Dependencies

Depends on Session store, Audit log, API tokens (revoke on delete), OAuth/OIDC (revoke grants).

Complexity

L