Add GDPR privacy export and deletion workflow

[gorkemio]

/claim #76

Summary

I added a GDPR-ready privacy workflow for exporting and deleting a user’s personal data.

What changed:

• Added GET /privacy/export, which returns a ZIP package with manifest.json, profile.json, data.json, and per-table CSV files for the authenticated user’s own records.
• Added DELETE /privacy/me, guarded by the explicit DELETE_MY_DATA confirmation, to permanently remove user-owned records.
• Kept auditability by anonymizing existing audit logs and retaining a deletion completion audit entry.
• Cleared user-scoped Redis cache keys and revoked matching refresh sessions during account deletion.
• Added Account page controls for downloading an export and deleting the account.
• Updated OpenAPI and README with the new privacy workflow.

Validation

• REDIS_URL=redis://localhost:6379/15 python -m pytest tests/test_privacy.py tests/test_auth.py from packages/backend (5 passed)
• REDIS_URL=redis://localhost:6379/15 python -m pytest from packages/backend (24 passed)
• python -m black --check packages/backend/app/routes/privacy.py packages/backend/tests/test_privacy.py
• python -m flake8 packages/backend/app/routes/privacy.py packages/backend/tests/test_privacy.py --config=.flake8
• npm run lint from app
• npm run build from app

Notes

Deletion is immediate and irreversible after the DELETE_MY_DATA confirmation, which matches the acceptance criteria for this issue.

[gorkemio]

Demo video for #76:

finmind-gdpr-demo.mp4

[gorkemio]

Demo video added. This is ready for review.

Thanks!