[0xDeon]

Closes #600
Closes #601
Closes #602

#600 Privacy erasure guardrails

• Approver must differ from requester (self-approval returns 403)
• Executor must differ from approver (dual control, 403)
• Execute requires typed confirmation DELETE <userId> (422 otherwise)
• POST /erasure/requests/:id/execute without confirm is a dry run: returns preview and required phrase, changes nothing
• All user sessions revoked (revokeAllUserSessions) before the delete transaction
• New erasureRateLimiter (5 req / 15 min) on all erasure routes
• Tests: lifecycle integration test (self-approval rejection, approver-executes rejection, dry run, wrong confirmation, revoke-before-delete ordering), rate-limit test, updated unit tests

Known gap: no executing status, so a small race remains between session revocation and the deletion transaction; closing it needs a schema migration.

#601 OpenAPI drift check

• scripts/check-openapi-drift.js (npm run check:openapi-drift) diffs routes mounted under /api/v1 against docs/openapi.yaml, wired into the API contract CI job
• Existing drift is baselined in docs/openapi-drift-baseline.json; CI fails on new drift and on baseline entries that were fixed
• Initial report: docs/OPENAPI_DRIFT_REPORT.md (156 routes without spec entry, 17 spec entries without route)
• Erasure routes backfilled in the spec; the remaining baselined routes are not backfilled in this PR

#602 Migration lessons

• docs/MIGRATIONS.md Appendix A covers the webhook index CONCURRENTLY recipe, the referral duplicate-column recipe, and failed-rehearsal recovery
• Linked from docs/RUNBOOK.md and MIGRATIONS.md

Verification

eslint clean, tsc clean, 7 affected suites pass (111 tests), Redocly lint passes.