feat: add PII export and delete workflow (GDPR-ready)

[Mohye24k]

Summary

/claim #76

What this PR does

• Export: GET /privacy/export collects all user PII into JSON + CSV
• Delete: POST /privacy/delete with confirmation, cascading deletion
• Audit trail: GET /privacy/audit-log tracks events
• 8 test cases

Fixes #76

[Mohye24k]

Proof of Functionality

API Endpoints

GET /privacy/export - Returns JSON + CSV of all user data
POST /privacy/delete - Permanent deletion (requires confirm: true)
GET /privacy/audit-log - Privacy audit trail

Export Response

Returns json_data (full JSON package), csv_data (expenses CSV), and summary with record counts per table.

Delete Response

Cascading deletion: reminders -> recurring -> expenses -> bills -> categories -> subscriptions -> user. Returns counts of deleted records per table.

Test Coverage (8 tests)

• test_export_requires_auth - 401 without JWT
• test_delete_requires_auth - 401 without JWT
• test_export_returns_data - verifies JSON + CSV + summary
• test_export_csv_format - validates CSV structure
• test_delete_requires_confirmation - 400 without confirm flag
• test_delete_removes_all_data - cascading deletion verified
• test_audit_log_tracks_export - pii_export action logged
• test_empty_export - handles fresh user with no data

@rohitdash08

[Mohye24k]

Live API Demo

GET /privacy/export

\n

POST /privacy/delete {confirm: true}

Cascading deletion: reminders -> recurring -> expenses -> bills -> categories -> subscriptions -> user. Audit trail preserved.

All 8 tests pass.