🔒 GDPR audit anonymize method + data provider

[PierreBrisorgueil]

Add an anonymize path for the retention-bound audit trail (today the repo can only hard-delete).

Scope

• AuditRepository.anonymizeByUser — new method: updateMany({ userId }, { $set: { userId: null, ip: '', userAgent: '', metadata: {} } }) (the repo exposes only deleteMany today).
• Register in audit.init.js, axis:'user', retention:'anonymize': export rows by userId only (never org-scoped → no co-member leak); erase = anonymizeByUser (keep action + timestamp; never delete the trail).
• Tolerate the audit model being absent when the module is deactivated.

DoD

• anonymizeByUser repo unit test.
• Provider keeps row count, nulls PII; export is userId-scoped.
• /verify green.

Depends on: GDPR registry leaf.

Created via /dev:issue