feat: GDPR PII Export/Delete Workflow

[chengyixu]

/claim #76

Summary

Full GDPR-compliant PII export, deletion, and anonymization workflow:

• Data Export (GET /gdpr/export): Downloads all user personal data as structured JSON (profile, expenses, categories, bills, recurring expenses, reminders, subscriptions, audit logs)
• Account Deletion with Grace Period (POST /gdpr/delete): 30-day grace period with password re-confirmation, cancellable via POST /gdpr/delete/cancel
• Immediate Irreversible Deletion (POST /gdpr/delete/confirm): Cascading hard-delete across all user-owned tables with password verification
• Data Anonymization (POST /gdpr/anonymize): Replaces PII with anonymous placeholders while preserving financial records for users who want history kept
• Immutable GDPR Audit Trail: Dedicated gdpr_audit_logs table with no FK to users (survives deletion), logging every export/delete/anonymize action with IP, user agent, timestamp, and details
• Admin Audit Log Viewer (GET /gdpr/audit-logs): Paginated, filterable by user, admin-only access
• Deletion Status Check (GET /gdpr/delete/status): Check if a deletion request is pending
• Frontend Privacy & Data Page: Full UI for export download, anonymization, and deletion with password confirmation flows
• 20 comprehensive tests covering all workflows, access control, idempotency, and audit trail persistence

Changes

File	Description
packages/backend/app/models.py	Added GdprAuditLog and DeletionRequest models
packages/backend/app/db/schema.sql	Added gdpr_audit_logs and deletion_requests tables with indexes
packages/backend/app/services/gdpr.py	Core GDPR service: export, delete, anonymize, audit logging
packages/backend/app/routes/gdpr.py	7 API endpoints under /gdpr/ with JWT auth and password verification
packages/backend/app/routes/__init__.py	Registered gdpr_bp blueprint
packages/backend/app/openapi.yaml	Full OpenAPI spec for all GDPR endpoints
packages/backend/tests/test_gdpr.py	20 tests: export, deletion, cancellation, anonymization, audit trail
app/src/api/gdpr.ts	Frontend API client for all GDPR endpoints
app/src/pages/Privacy.tsx	Privacy & Data management page
app/src/pages/Account.tsx	Added "Manage Privacy" link to Account Settings
app/src/App.tsx	Added /privacy route

Test plan

• All 20 GDPR tests pass
• All 22 existing tests pass (no regressions)
• Export returns all user data categories with correct structure
• Export only returns data owned by the requesting user
• Deletion requires password re-confirmation
• Deletion request creates pending state with 30-day grace period
• Duplicate deletion requests are idempotent
• Cancellation during grace period works correctly
• Immediate deletion cascades across all tables
• GDPR audit logs survive user deletion (no FK constraint)
• Anonymization replaces PII in all free-text fields
• Admin-only access control on audit log viewer
• Frontend Privacy page integrates with all API endpoints

🤖 Generated with Claude Code