feat: GDPR data controls — soft-delete + data export

[TrainTravel]

Summary

Two GDPR Tier-1 features in one PR, surfaced from a new AccountScreen:

1. Account deletion with 30-day soft-delete grace (Article 17 — right to erasure)
2. Data export — download all user data as JSON (Article 20 — right to portability)

How it works

• New AccountScreen reachable from a footer "Account & data" link on HomeScreen.
• Delete: confirmation modal explains the 30-day undo window → invokes schedule-account-deletion edge function → sets profiles.scheduled_deletion_at = now() + 30 days → signs the user out.
• Cancel: returning within 30 days shows a yellow banner with a one-click cancel → invokes cancel-account-deletion.
• Hard purge: AccountScreen lazily triggers hard-delete-account if the user returns after the deadline (CASCADE through thoughts, clusters, journal_entries, experiments, feedback, profiles, and finally auth.users).
• Export: "Download my data" button invokes export-user-data → returns versioned JSON (schema_version: 1) with every row tagged with the caller's user_id → browser saves as outputfirst-export-YYYY-MM-DD.json via Blob + <a download> (no new dependency).

⚠ DEPLOYMENT STEPS — must run before merging

1. Apply migration:

   supabase db push

   Or apply supabase/migrations/20260523145704_account_soft_delete.sql via the dashboard. Creates public.profiles with strict RLS (id = auth.uid()).

2. Set secret:

   supabase secrets set SUPABASE_SERVICE_ROLE_KEY=<value>

   Required by all 4 new edge functions for cross-table writes.

3. Deploy edge functions:

   supabase functions deploy schedule-account-deletion cancel-account-deletion hard-delete-account export-user-data

v1 limitation (documented in code + CHANGELOG)

No pg_cron job yet. A user who never returns after day 30 is not actually purged until they return. Production should add a scheduled job that invokes hard-delete-account for every row with scheduled_deletion_at < now(). Captured as a follow-up.

Test plan

• npx tsc --noEmit — clean
• npx vitest run — 195 passed / 196 total (only pre-existing useJournal startFreeWrite fails; confirmed unchanged on main)
• 11 unit tests in AccountScreen.test.tsx (render, modal flow, banner, cancel, lazy purge, export click, in-flight disabled state)
• 2 unit tests added to useJournal.test.ts (openAccount step transition + goHome from account)
• 4 E2E tests in e2e/gdpr-account.spec.ts (footer link opens screen, delete schedules POST, banner+cancel, download triggers .json)
• Post-rebase codemod sweep — converted 27 positional t() calls in AccountScreen + HomeScreen to object form (matches post-refactor: t() / bilingual() positional → object form #32 main)
• Manual after deployment: schedule deletion → banner appears → cancel → banner gone
• Manual: download → file lands on disk, contents reflect all user rows

Out of scope (follow-up PRs)

• Privacy policy text (the /privacy page from PR docs: sync CLAUDE.md memory with latest CHANGELOG state #34 has the route + UI; legal text still placeholder)
• Consent banner for first-visit storage gating
• pg_cron hard-delete worker
• Granular consent toggles per processing activity

🤖 Generated with Claude Code