feat(privacy): GDPR-ready PII export & account deletion with audit trail

[bkennedyshit]

Closes #76

Summary

Full GDPR-compliant PII export and account deletion workflow with audit logging.

Features

• ✅ POST /privacy/export — creates export job, returns job_id
• ✅ GET /privacy/export/:job_id — polls status, returns ZIP download when ready
• ✅ ZIP contains: profile, expenses, bills, categories, budgets as JSON
• ✅ DELETE /privacy/account — requires {"confirmation": "DELETE"}, irreversible
• ✅ GET /privacy/audit — full audit trail of all export/delete requests
• ✅ All requests logged with timestamp, IP, user_id
• ✅ Frontend Privacy page at /privacy with 3 sections:
  • Export My Data → triggers job → auto-downloads ZIP on completion
  • Delete My Account → requires typing DELETE to confirm → irreversible
  • Audit Log → full history of requests

Files Changed

• packages/backend/app/routes/privacy.py (new)
• app/src/api/privacy.ts (new API client)
• app/src/pages/Privacy.tsx (new page)
• app/src/App.tsx (route)
• app/src/components/layout/Navbar.tsx (nav link)