feat: Cookie-Banner ↔ Backend Integration (DSR, Retention, Consent Proof)

Phase 1: Vendor sync from service registry (82+ services → banner vendors)
Phase 2: Category-based retention (marketing=90d, statistics=790d, not hardcoded 365d)
Phase 3: DSR ↔ Banner email linking (link-email, by-email, Art.17 erasure, Art.15/20 export)
Phase 4: Consent sync (Banner → Einwilligungen bridge)
Phase 6: Consent proof (SHA256 config hash + config_version in audit log, Art. 7(1) DSGVO)

New files:
- banner_dsr_service.py — email linking + DSR integration
- vendor_banner_sync.py — service registry → vendor configs
- migration 106 — linked_email, banner_config_hash, consent_version columns

Tests: 20+ new backend tests + 2 Playwright E2E test suites (API + UI)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/db/banner_models.py

@@ -34,6 +34,7 @@ class BannerConsentDB(Base):
     ip_hash = Column(Text)
     user_agent = Column(Text)
     consent_string = Column(Text)
+    linked_email = Column(Text)
     expires_at = Column(DateTime)
     created_at = Column(DateTime, nullable=False, default=datetime.utcnow)
     updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
@@ -42,6 +43,8 @@ class BannerConsentDB(Base):
         Index('idx_banner_consent_tenant', 'tenant_id'),
         Index('idx_banner_consent_site', 'site_id'),
         Index('idx_banner_consent_device', 'device_fingerprint'),
+        Index('idx_banner_consent_email', 'linked_email',
+              postgresql_where='linked_email IS NOT NULL'),
     )
 
 
@@ -58,6 +61,8 @@ class BannerConsentAuditLogDB(Base):
     device_fingerprint = Column(Text)
     categories = Column(JSON, default=list)
     ip_hash = Column(Text)
+    banner_config_hash = Column(Text)
+    consent_version = Column(Integer)
     created_at = Column(DateTime, nullable=False, default=datetime.utcnow)
 
     __table_args__ = (
@@ -85,6 +90,7 @@ class BannerSiteConfigDB(Base):
     dsb_email = Column(Text)
     theme = Column(JSON, default=dict)
     tcf_enabled = Column(Boolean, default=False)
+    config_version = Column(Integer, nullable=False, default=1)
     is_active = Column(Boolean, nullable=False, default=True)
     created_at = Column(DateTime, nullable=False, default=datetime.utcnow)
     updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)