feat: GDPR-compliant PII export and deletion workflow

[shaidshark]

Summary

This PR implements a complete GDPR-compliant PII export and deletion workflow for FinMind, addressing issue #76.

Features Implemented

Export Endpoint (GET /gdpr/export)

• Generates a ZIP file containing complete user data export
• Includes all PII: user profile, categories, expenses, recurring expenses, bills, reminders, ad impressions, subscriptions
• Returns downloadable archive with README instructions
• Audit logging for every export request

Deletion Request Workflow

• POST /gdpr/delete-request: Initiates 30-day grace period before permanent deletion
• DELETE /gdpr/delete-request: Cancels pending deletion request during grace period
• GET /gdpr/status: Shows pending deletion status and days remaining

Immediate Deletion (DELETE /gdpr/delete)

• Requires explicit confirmation
• Irreversible deletion of all user data
• Respects foreign key constraints (deletes in correct order)
• Anonymizes ad impressions instead of deleting (keeps analytics)
• Audit trail preserved even after user deletion

Database Changes

• Added deletion_requests table for grace period tracking
• Added audit_logs table for GDPR action logging
• All tables have proper foreign key constraints

Technical Improvements

• Made Redis initialization lazy for better test compatibility
• Added fakeredis for unit testing without Redis dependency
• Comprehensive test suite with 9 passing tests

Acceptance Criteria

• Export package generation
• Irreversible deletion workflow
• Audit trail logging
• 30-day grace period option
• Tests included
• Documentation in README

Fixes #76