feat: add subject access request (SAR) data export for staff console

[Joe-Heffer-Shef]

Summary

Implements #582 — a staff console action that generates a UK GDPR Article 15 subject access export for a given user, as JSON.

Screenshots

Changes

This wires up DataProtectionEvent.EventType.EXPORT, which was already defined in the data protection audit log but documented as "reserved" (docs/data-protection.md) pending this exact flow.

• New UserService.export_personal_data(user) builds a dict of the user's own data: profile fields, organisation memberships (their own only), and projects they created — reusing the same queries as the existing ConsoleUserDetailView.
• New ConsoleExportUserDataView (staff-only) follows the existing GET-confirm / POST-act console pattern used by ConsoleDeleteUserView. POST returns the export as a downloadable JSON attachment and merges in the user's data_protection_history (their own audit events, with staff identities stripped), then records a new export audit event via data_protection_service.record_event.
• Export is blocked for already-anonymised (erased) accounts, since there's nothing meaningful left to export.
• New "Export data (SAR)" button on the user detail page.

Scope note

The issue's suggested scope mentions survey responses and invitations, but in this schema neither SurveyResponse nor Invitation has a foreign key to User — responses are anonymous (collected via invitation token) and invitations only carry a raw email address. So there's no account-linked survey/invitation data to include; the real personal-data surface for a User account is profile fields, their own organisation memberships, projects they created, and their own data protection history. This export deliberately excludes other organisation members' data even where membership records are shared.

Test plan

• python manage.py test home/tests/test_console_views.py --failfast — new tests cover: GET confirmation, POST JSON download + content, exclusion of other members' personal data, audit event recording, 403 for erased accounts, staff-only access, anonymous redirect.
• python manage.py test home/tests --parallel=auto --failfast — full home suite passes (114 tests).
• python manage.py check / makemigrations --check --dry-run — no issues, no missing migrations.
• Manually verified end-to-end against a running dev server: logged in as staff, loaded /console/users/<pk>/, confirmed the "Export data (SAR)" button and confirmation page render, POSTed to download the JSON export with correct Content-Disposition/Content-Type and expected data, and confirmed the new export event appears in /console/data-protection/.

🤖 Generated with Claude Code

[twinkarma]

LGTM