Issue #3593603: owner vault export (GDPR data portability)

Add an owner-initiated 'download my data' action: a confirm form streams a ZIP of the owner's whole current-tenant vault (documents under their original filename, records as JSON) plus a manifest.json index. The bundle is built synchronously to a private:// temp file and deleted once sent, so nothing decrypted is left at rest. Throttled per owner via the existing flood guard (shared consent window, new export_limit) and recorded on a new pdv.export audit channel. Owner access only; no grants or trust involved.

Closes #3593603