🔒 GDPR Vue — async export UI + hardened delete-account (password/OAuth branch)

[PierreBrisorgueil]

Front-end for the two data-subject rights (async export + hardened erasure).

Scope — src/modules/users/views/user.profile.view.vue (+ small store/api touches if needed)

• Export: "Request my data" → POST /users/me/data/exports (202) → status list (GET /users/me/data/exports, poll while pending/processing) → "Download" when ready (GET /users/me/data/exports/:id, authenticated blob download). Show expiry.
• Delete account: repoint from DELETE /users (route removed server-side) to DELETE /users/me/data. Confirm dialog branches by account type: password account → password re-entry field; OAuth-only account → "send confirmation code" flow (short-lived token from the confirm endpoint). Surface the erasure receipt (what was removed / what is retained and why) on success.
• Nudge export-before-erase in the delete dialog (access-before-erasure best practice).
• Optional: export/erasure-rights copy in the legal privacy template (incl. backup-retention window sentence).

DoD

• /verify + build green.
• /dev:verify-qa visual smoke of both flows against the running Node API (runtime-verify the real contract shape, not a self-authored mock).

Depends on: export+erasure controller, re-auth hardening, async export pipeline (the backend contract).

Created via /dev:issue · contract v2 2026-07-03