feat(privacy): PII export & delete workflow (GDPR-ready)

[zp6]

Changes

Implements GDPR-ready PII export and deletion as requested in #76.

New files

• packages/backend/app/routes/privacy.py - Two authenticated endpoints:
  • GET /privacy/export - Exports all user data (profile, expenses, categories, bills, reminders, subscriptions) as JSON
  • DELETE /privacy/delete - Irreversibly deletes all personal data (requires {"confirm": "DELETE_MY_DATA"} body)
• packages/backend/app/services/privacy.py - Service layer with export_user_data() and delete_user_data()

Modified files

• packages/backend/app/routes/__init__.py - Register privacy blueprint at /privacy

Security

• Both endpoints require JWT authentication
• Deletion requires explicit confirmation string
• Deletion happens in dependency order (children first)
• Audit logs are retained with user_id=NULL for compliance
• All operations are logged

Testing

`�ash
curl -H 'Authorization: Bearer ' http://localhost:5000/privacy/export
curl -X DELETE -H 'Authorization: Bearer ' -H 'Content-Type: application/json' -d '{"confirm":"DELETE_MY_DATA"}' http://localhost:5000/privacy/delete
``n
Fixes #76

---

Wallet: zp6