feat: add milestone 9D privacy lifecycle candidate

[joonas-001]

Summary

• Adds versioned candidate privacy policies, full-text SHA-256 acceptance records, and separately controlled optional purposes.
• Adds current-user access, correction and portable export flows plus a settings privacy center.
• Adds seven-day cancellable deletion, transactional private-data purge, 180-day minimal tombstones, and deletion-ledger replay after encrypted backup restoration.
• Keeps Clerk, real identities/data, external AI/sources, email, 6D production changes, cloud resources and paid resources out of scope.

Validation

• release-readiness passed
• 172 backend tests passed; 1 expected skip
• 46 frontend tests and production build passed
• 26 E2E tests passed; 6 scoped skips
• Governance, contract drift and secret scanning passed

Remaining gates

Policy text remains a synthetic candidate. Professional review, a dedicated privacy/support contact, supplier-region and contract validation, and separate authorization for 9E-9H remain required.