feat: GDPR data export and account deletion workflow

[Copilot]

No standard "download my data" or "delete account" workflow existed across packages. This adds GDPR Article 17 (erasure) and Article 20 (portability) support.

Backend — worker/routes/user-data.ts

• GET /api/users/me/export — Collects user data across all registered models (profile, accounts, sessions, roles, memberships, audit logs, todos, plus conditionally comments/referrals if enabled), strips sensitive fields (passwordHash, OAuth tokens), returns as downloadable JSON.
• POST /api/users/me/delete — Cascading delete of all user-owned rows after email confirmation. Audit logs are anonymized rather than deleted to preserve the compliance trail.

Both endpoints are rate-limited and session-authenticated. Deletion requires the user to echo their email address back.

Frontend — UserProfilePage.tsx

New "Data & Privacy" card added to existing profile settings page:

• Export button triggers blob download
• Delete button opens confirmation dialog requiring email input; hard-redirects to / after deletion to clear all client state

Route wiring — router.ts

Two new route entries in the existing method dispatchers.

Tests — 11 unit tests

Covers auth gates, email mismatch rejection, sensitive field stripping, audit log anonymization, and the happy path for both export and delete.

// Export: strips passwordHash, OAuth tokens from output
const body = JSON.parse(await response.text());
expect(body.profile.passwordHash).toBeUndefined();
expect(body.accounts[0].access_token).toBeUndefined();

// Delete: anonymizes audit logs instead of deleting
expect(auditLog.set).toHaveBeenCalledWith('userEmail', ANONYMIZED_USER_EMAIL);
expect(auditLog.save).toHaveBeenCalled();

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.