B2B-14 · LGPD: data-subject export/deletion, consent, retention

Part of the B2B epic (Bloco 3 · item 3.5). Compliance groundwork — low relative cost, high commercial value for B2B/NGO sales in Brazil. **Recommended early.**

## What
- [ ] Data-subject deletion endpoint: `ory.service.ts:139-145` `deleteIdentity()` exists **but has no HTTP endpoint**; wire to the existing soft-delete cascade (`management.service.ts`)
- [ ] Data-subject export endpoint (all data tied to a user)
- [ ] Consent field(s) on `user.schema`
- [ ] Retention TTL policy

**Effort:** ~2 SP · **Depends on:** —