feat: GDPR PII export, account deletion & audit trail

[CorradoZDeLuca]

Summary

Implements the GDPR PII Export & Delete workflow requested in #76:

• GET /gdpr/export — Collects all user-linked data (profile, categories, expenses, recurring expenses, bills, reminders, subscriptions) into a structured JSON download. Excludes password_hash. Logs a PII_EXPORT audit event.
• POST /gdpr/delete — Permanently deletes the user account after password re-verification. Uses the existing ON DELETE CASCADE foreign keys for clean removal. Writes an ACCOUNT_DELETED audit log entry that survives deletion via ON DELETE SET NULL.
• GET /gdpr/audit — Returns the user's audit trail sorted by most recent first.

Implementation Details

• Follows existing codebase patterns: Flask Blueprint, @jwt_required(), SQLAlchemy queries
• 3 files changed: new routes/gdpr.py, new tests/test_gdpr.py, updated routes/__init__.py
• No schema migrations needed — leverages existing FK cascade behavior
• Password re-verification required before deletion (uses check_password_hash)
• Audit logs persist after user deletion (user_id becomes NULL per existing schema)

Tests

18 tests covering:

• Auth guards (401 on unauthenticated requests)
• Export completeness (all 7 data tables included)
• Password hash exclusion from exports
• Audit log creation on export
• Password verification for deletion
• Wrong password rejection
• User removal confirmation
• Cascade deletion of expenses and categories
• Audit log preservation after user deletion
• Audit trail retrieval

Checklist

• Follows existing code style and patterns
• All endpoints require JWT authentication
• Password re-verification before irreversible deletion
• Audit trail survives account deletion
• Tests included for all acceptance criteria
• No new dependencies added

/claim #76

Closes #76

[CorradoZDeLuca]

Hi @rohitdash08 👋

Just wanted to check in — this PR implements the full GDPR PII Export & Delete workflow for #76 with 18 tests covering all acceptance criteria. No new dependencies needed, and it follows the existing codebase patterns.

Happy to make any changes if you have feedback. Looking forward to your review!

Thanks for maintaining this project 🙏

[rohitdash08]

@CorradoZDeLuca, please connect over discord for the feedback @geekster007