privacy: user data export, deletion, retention policy

[jonmatum]

Priority: P1
Parent: #34

Context

Once the service accepts external users (self-signup is now configurable per allow_self_signup), the project inherits basic privacy obligations: give users a way to see, export, and delete their data, and state how long data is kept.

Requirements

Policy (docs/privacy.md)

• What is collected (capture text, metadata, embeddings, audit, analytics)
• Retention defaults (audit TTL 90 d already; document the rest)
• Data residency (single region today)
• User rights: export, deletion, correction

Export

• GET /me/export — returns a signed S3 URL to a JSON bundle of the user's nodes, edges, audit records (excluding embeddings unless requested)
• Async if the user has > N nodes (e.g. 5 000)

Deletion

• DELETE /me — soft-delete user: remove Cognito account, tombstone their nodes (owner cleared), schedule a hard-delete Lambda to remove S3 bodies and DDB items within 30 days
• Audit trail preserved with user ID replaced by a hash (for compliance)

Retention

• Document + enforce: audit items 90 d TTL, soft-deleted nodes 30 d, exported bundles 7 d
• Terraform lifecycle policies on relevant S3 prefixes

Acceptance criteria

• privacy.md published
• Export + delete flows tested on a test Cognito user end-to-end
• Retention lifecycle rules applied in both envs

References

• Production readiness — consolidated plan (tracking) #34 (parent)