Fas 1a: product analytics schema + GDPR controls

apps/api/src/routes/auth.ts

@@ -54,6 +54,16 @@ export async function authRoutes(app: FastifyInstance) {
       .values({ userId: user.id })
       .onConflictDoNothing();
 
+    // Product analytics: legitimate interest with opt-out (spec §8, §33).
+    const consentNow = new Date();
+    await app.db.insert(schema.userConsents).values({
+      userId: user.id,
+      kind: "product_analytics",
+      status: "granted",
+      grantedAt: consentNow,
+      updatedAt: consentNow,
+    });
+
     // 7 dagars trial utan kort startar direkt (spec §46)
     const now = new Date();
     await app.db

apps/api/src/routes/me.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from "fastify";
 import { eq } from "drizzle-orm";
-import { schema } from "@app/database";
+import { deleteUserAnalyticsEvents, schema } from "@app/database";
 import {
   consentInputSchema,
   onboardingInputSchema,
@@ -316,6 +316,7 @@ export async function meRoutes(app: FastifyInstance) {
       .delete(schema.userHealthProfiles)
       .where(eq(schema.userHealthProfiles.userId, userId));
     await app.db.delete(schema.userPreferences).where(eq(schema.userPreferences.userId, userId));
+    await deleteUserAnalyticsEvents(app.db, userId);
     await app.db.delete(schema.refreshTokens).where(eq(schema.refreshTokens.userId, userId));
     await app.db.delete(schema.userCredentials).where(eq(schema.userCredentials.userId, userId));
     await app.db