feat(gdpr): fullständig raderingsflöde med pseudonym-retention, residual-test och hushållshantering

- Implementerar eraseUser() i packages/database/src/gdpr-erasure.ts som
  raderar/anonymiserar/pseudonymiserar alla personliga tabeller.
- DELETE /v1/me orkestrerar nu plan + transaktion + lagringsrensning.
- Enpersonshushåll raderas automatiskt; publika recept anonymiseras;
  draft/private-recept raderas.
- Finansiella poster (subscriptions/store_transactions/subscription_events)
  behålls under retention med slumpmässig pseudonym från
  gdpr_retention_pseudonyms.
- audit_logs/domain_events anonymiseras; kvitton i kvarvarande hushåll
  strippas på bild och OCR-text.
- Lägger till permanent residual-test (me.residual.test.ts) med
  schema-diff-assertion mot information_schema.
- Uppdaterar docs/23 och docs/29 med implementerad mekanism.
- Migration 0021 för gdpr_retention_pseudonyms och nullable
  cooking_sessions.started_by_user_id.

infrastructure/migrations/0021_gdpr_retention_pseudonyms.sql

@@ -0,0 +1,77 @@
+-- GDPR-retention pseudonyms (docs/29).
+-- Financial/audit records are retained for legal/tax/dispute purposes,
+-- but the natural person must not be directly identifiable after deletion.
+CREATE TABLE IF NOT EXISTS "gdpr_retention_pseudonyms" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL REFERENCES "public"."users"("id") ON DELETE cascade,
+	"pseudonym" uuid NOT NULL,
+	"retention_until" timestamp with time zone NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"deleted_at" timestamp with time zone,
+	CONSTRAINT "gdpr_retention_pseudonyms_user_id_unique" UNIQUE("user_id"),
+	CONSTRAINT "gdpr_retention_pseudonyms_pseudonym_unique" UNIQUE("pseudonym")
+);
+--> statement-breakpoint
+ALTER TABLE "subscriptions" DROP CONSTRAINT IF EXISTS "subscriptions_user_id_users_id_fk";
+--> statement-breakpoint
+ALTER TABLE "subscriptions" ALTER COLUMN "user_id" DROP NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "subscriptions" ADD COLUMN IF NOT EXISTS "pseudonym" uuid;
+--> statement-breakpoint
+DO $$
+BEGIN
+	ALTER TABLE "subscriptions" ADD CONSTRAINT "subscriptions_user_id_users_id_fk"
+		FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE set null;
+EXCEPTION WHEN duplicate_object THEN
+	NULL;
+END $$;
+--> statement-breakpoint
+DO $$
+BEGIN
+	ALTER TABLE "subscriptions" ADD CONSTRAINT "subscriptions_pseudonym_gdpr_retention_pseudonyms_pseudonym_fk"
+		FOREIGN KEY ("pseudonym") REFERENCES "public"."gdpr_retention_pseudonyms"("pseudonym") ON DELETE set null;
+EXCEPTION WHEN duplicate_object THEN
+	NULL;
+END $$;
+--> statement-breakpoint
+ALTER TABLE "subscription_events" ADD COLUMN IF NOT EXISTS "pseudonym" uuid;
+--> statement-breakpoint
+DO $$
+BEGIN
+	ALTER TABLE "subscription_events" ADD CONSTRAINT "subscription_events_pseudonym_gdpr_retention_pseudonyms_pseudonym_fk"
+		FOREIGN KEY ("pseudonym") REFERENCES "public"."gdpr_retention_pseudonyms"("pseudonym") ON DELETE set null;
+EXCEPTION WHEN duplicate_object THEN
+	NULL;
+END $$;
+--> statement-breakpoint
+ALTER TABLE "store_transactions" ADD COLUMN IF NOT EXISTS "pseudonym" uuid;
+--> statement-breakpoint
+DO $$
+BEGIN
+	ALTER TABLE "store_transactions" ADD CONSTRAINT "store_transactions_pseudonym_gdpr_retention_pseudonyms_pseudonym_fk"
+		FOREIGN KEY ("pseudonym") REFERENCES "public"."gdpr_retention_pseudonyms"("pseudonym") ON DELETE set null;
+EXCEPTION WHEN duplicate_object THEN
+	NULL;
+END $$;
+--> statement-breakpoint
+ALTER TABLE "cooking_sessions" DROP CONSTRAINT IF EXISTS "cooking_sessions_started_by_user_id_users_id_fk";
+--> statement-breakpoint
+ALTER TABLE "cooking_sessions" ALTER COLUMN "started_by_user_id" DROP NOT NULL;
+--> statement-breakpoint
+DO $$
+BEGIN
+	ALTER TABLE "cooking_sessions" ADD CONSTRAINT "cooking_sessions_started_by_user_id_users_id_fk"
+		FOREIGN KEY ("started_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null;
+EXCEPTION WHEN duplicate_object THEN
+	NULL;
+END $$;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "gdpr_retention_pseudonyms_user_idx" ON "gdpr_retention_pseudonyms" USING btree ("user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "gdpr_retention_pseudonyms_pseudonym_idx" ON "gdpr_retention_pseudonyms" USING btree ("pseudonym");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "subscriptions_pseudonym_idx" ON "subscriptions" USING btree ("pseudonym");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "subscription_events_pseudonym_idx" ON "subscription_events" USING btree ("pseudonym");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "store_transactions_pseudonym_idx" ON "store_transactions" USING btree ("pseudonym");

infrastructure/migrations/meta/_journal.json

@@ -141,6 +141,13 @@
       "when": 1786144800000,
       "tag": "0020_ai_corrections_training_bank",
       "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "7",
+      "when": 1786144900000,
+      "tag": "0021_gdpr_retention_pseudonyms",
+      "breakpoints": true
     }
   ]
 }