GDPR data portability — self-service "download my data" export (Art. 20)

[denisvmedia]

Context

#2147 (PR #2176) ships GDPR right-to-erasure (Art. 17) — a user can now delete their own account + owned data via DELETE /api/v1/auth/me. The distinct right to data portability (GDPR Art. 20 — "give me a copy of all my data") is not covered and there is no per-user self-service export today.

Confirmed during the #2147 build:

• Exports are group-admin only: POST/GET /api/v1/g/{slug}/exports/* gate on group membership + admin role and export the group's full_database (.inb archive), not a single user's profile/preferences/owned items.
• GET /api/v1/backup/public-key is verification-only.
• So a regular user (especially a non-admin member) has no way to download their own data, and the account-deletion dialog can only tell them to "back up first" via a group owner.

Scope / Acceptance criteria

• Authenticated GET /api/v1/users/me/export (or /auth/me/export) that returns the caller's own data: profile/preferences + the inventory they own (commodities, files, areas, locations, tags, exports) in a portable format.
• Decide format: reuse the .inb streaming archive (signed, already built — internal/inb / internal/backupsign) scoped to the user, vs. a simpler JSON+files bundle. Honor tenant/group scoping.
• Per-user rate limit (these are expensive) + audit event.
• Surface it in Settings → Account ("Download my data") and reference it from the delete-account dialog's "export first" warning.
• e2e + swagger.

Notes

Erasure (#2147) and portability (this issue) are deliberately separate GDPR rights; #2147 intentionally scoped portability out. Tracked under #1651 / #2087 (alpha-readiness, EU/CZ market).