🔒 GDPR organizations + invitations data providers (anonymize cross-refs)

[PierreBrisorgueil]

Self-register the organizations + invitations GDPR providers — anonymize cross-references rather than orphan them.

Scope

• organizations.init.js — axis:'user': export memberships-by-user + orgs-created-by-user; erase hard-deletes the user's own memberships, anonymizes addedBy/createdBy on other users' shared rows, routes sole-owned orgs through the existing OrganizationsCrudService.remove cascade, and reconciles co-members' currentOrganization.
• invitations.init.js — axis:'user', retention:'anonymize': export invites-sent (token stripped) + invite-accepted; erase nulls invitedBy / scrubs email + acceptedUserId, keeping the attribution skeleton (soft-revoke house pattern).

DoD

• Init unit tests for both providers.
• Erasure preserves other users' valid memberships + referral attribution.
• /verify green.

Depends on: GDPR registry leaf.

Created via /dev:issue