Build GDPR compliance system: data export, account deletion, consent

- Data export (Art. 15/20): GET /api/gdpr/export serves a full JSON export
  of the user's data (credentials/tokens excluded, exclusions declared)
- Right to erasure (Art. 17): self-service deletion with 30-day grace
  period (Settings -> Privacy & Data), cancellable; daily /api/cron/gdpr
  drain cancels Stripe billing, purges Spaces files, cascade-deletes the
  account, anonymizes consent rows, and writes audit evidence
- Migration 0011: account_deletion_requests (partial unique index = one
  pending per user) + FK-less consent_log (survives erasure)
- Consent: terms/privacy acceptance logged at signup (email + Google);
  cookie banner with analytics opt-out (umami.disabled), choices logged
  server-side for signed-in users via POST /api/gdpr/consent
- Admin deleteUser upgraded to the same full purge (was leaving Spaces
  files and Stripe subscriptions orphaned)
- /gdpr legal page now points at the self-service tools
- scripts/verify-gdpr.ts: end-to-end verification vs live dev DB (22/22)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/auth.ts

@@ -3,8 +3,9 @@ import { drizzleAdapter } from "better-auth/adapters/drizzle"
 import { nextCookies } from "better-auth/next-js"
 import { admin } from "better-auth/plugins"
 import { db } from "@/lib/db"
-import { user, session, account, verification, profiles } from "@/lib/db/schema"
+import { user, session, account, verification, profiles, consent_log } from "@/lib/db/schema"
 import { sendEmail, resetPasswordHtml, verifyEmailHtml } from "@/lib/email/send"
+import { LEGAL } from "@/lib/legal"
 
 // Bootstrap superadmins from env — no API path lets a user self-promote.
 const ADMIN_USER_IDS = (process.env.ADMIN_USER_IDS ?? "")
@@ -80,6 +81,30 @@ export const auth = betterAuth({
           } catch {
             // Never block sign-up on profile creation.
           }
+          // GDPR proof of acceptance: the signup form states that creating an
+          // account means agreeing to the Terms and Privacy Policy.
+          try {
+            await db.insert(consent_log).values([
+              {
+                user_id: u.id,
+                email: u.email,
+                kind: "terms" as const,
+                granted: true,
+                policy_version: LEGAL.lastUpdated,
+                source: "signup",
+              },
+              {
+                user_id: u.id,
+                email: u.email,
+                kind: "privacy" as const,
+                granted: true,
+                policy_version: LEGAL.lastUpdated,
+                source: "signup",
+              },
+            ])
+          } catch {
+            // Never block sign-up on consent logging.
+          }
         },
       },
     },