Phase 4 + GDPR: team analytics, central templates, account export/deletion

Teams:
- GET /v1/teams/{id}/analytics (admin) — per-card visits/qr/saves/clicks across
  members, sortable (whitelisted columns); …/analytics.csv exports RFC-4180 CSV
- Central template library (migration 0004 team_templates):
  POST|DELETE /v1/teams/{id}/templates[/{templateId}] (admin), GET (member)

GDPR (§18.3):
- GET /v1/account/export — full JSON dump via Postgres json_agg (no password hash)
- DELETE /v1/account — hard delete, FK cascade removes all owned data

107 backend tests; fmt + clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-db/migrations/0004_team_templates.sql

@@ -0,0 +1,13 @@
+-- 0004_team_templates.sql — central template library for teams (PRD §6.1.4,
+-- Phase 4: admin-managed templates shared with team members).
+
+CREATE TABLE team_templates (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    team_id    UUID NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    name       TEXT NOT NULL,
+    definition JSONB NOT NULL,
+    created_by UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_team_templates_team ON team_templates(team_id);