B2B-14 · LGPD: data-subject export/deletion, consent, retention

Part of the B2B epic (Bloco 3 · item 3.5). Compliance groundwork — low relative cost, high commercial value for B2B/NGO sales in Brazil. **Recommended early.**

## What
- [ ] Data-subject deletion endpoint: `ory.service.ts:139-145` `deleteIdentity()` exists **but has no HTTP endpoint**; wire to the existing soft-delete cascade (`management.service.ts`)
- [ ] Data-subject export endpoint (all data tied to a user)
- [ ] Consent field(s) on `user.schema`
- [ ] Retention TTL policy

**Effort:** ~2 SP · **Depends on:** —

Start with ory.service.ts:139-145 and management.service.ts to understand the existing deletion flow and its soft-delete cascade. Then locate user.schema and the HTTP endpoint structure, and determine how export, consent, and retention requirements fit together. Done means the deletion and export endpoints, consent fields, and retention TTL policy are implemented and covered by the project’s relevant checks.

Escrito por el modelo de indexación a partir del texto del issue.