🔒 GDPR uploads data provider — NEW uploads.init.js + avatar-orphan test

[PierreBrisorgueil]

Self-register the uploads module's GDPR provider — and prove the avatar binary is caught.

Scope

• Create modules/uploads/uploads.init.js (none exists today) registering registerDataProvider({ key:'uploads', axis:'user', retention:'delete', export, erase }).
• Reuse UploadsDataService.list / remove (metadata.user-scoped).
• The avatar binary is caught because gridfs.js:21 tags metadata.user on the avatar upload.

DoD

• Init unit test (registers, delegates, deactivated → absent, no crash).
• Avatar-orphan integration test: create user → upload avatar → erase → assert uploads.files + uploads.chunks count == 0 for that user.
• /verify green.

Depends on: GDPR registry leaf.

Created via /dev:issue