feat(export): add readable account archive

docs/verification/application-action-matrix.md

@@ -50,6 +50,7 @@ This is the rolling action-level evidence index. `PASS (automated/runtime)` is n
 | Public CV | responsive A4/multi-page framing without inner or outer overflow | PASS (component) | PASS — 375px Chromium | NOT RUN | `accessibility-evidence.md`, V-170 |
 | Public plans | exactly Free/Pro; no invented tier, price, interval, trial or unlimited claim | PASS (catalogue + landing components) | PASS — Light/Dark at 375/768/1440 | NOT RUN | `product-001-honest-plans.md`, V-171 |
 | Public plans | Free registration and Pro sign-in-to-Settings actions | PASS (component) | PASS — keyboard activation | NOT RUN | `product-001-honest-plans.md`, V-171 |
+| Account export | recent-sign-in/rate-limit gate; complete redacted owner ZIP, files, warnings and checksums | PASS (real SQLite + components) | PASS — fresh synthetic Free download response and success state | NOT RUN with production data | `sec-009-account-lifecycle.md`, V-174 |
 | Pro promotion | benefit-specific locked notice, preserved-data copy and session dismissal | PASS (components) | NOT RUN on every contextual surface | NOT RUN | `product-001-honest-plans.md`, V-171 |
 | Billing presentation | checkout/portal only when server status permits; unconfigured deployment disclosed | PASS (components + policy slice) | NOT RUN with configured Stripe | NOT RUN | `product-001-honest-plans.md`, V-171 |
 | Admin safety | self/other Admin demotion confirmation and final-admin API protection | PASS (controller + components) | NOT RUN | NOT RUN | V-161 |

docs/verification/sec-009-account-lifecycle.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-15
 
-Status: `IN PROGRESS`. Generated-output ownership is now explicit. Readable export and the disabled deletion lifecycle remain to be implemented.
+Status: `IN PROGRESS`. Generated-output ownership and the readable export are implemented. The disabled deletion lifecycle remains to be implemented.
 
 ## Owner inventory boundary
 
@@ -18,19 +18,33 @@ The authoritative inventory must include Identity-safe account/profile fields an
 
 No existing generated file is moved or guessed. Legacy shared-date outputs stay a separately reviewed rollout concern because they cannot be attributed safely.
 
+## Checkpoint 2 — complete readable export
+
+- Authenticated `POST /api/export/account` requires the current local session to have been created within the last 15 minutes and is limited to two requests per user per hour.
+- One service owns both the authoritative row inventory and file inventory. It queries with explicit owner predicates and `IgnoreQueryFilters`, so soft-deleted applications remain portable and an absent/requestless tenant scope cannot silently empty the export.
+- The ZIP contains readable account, company, opportunity, application, correspondence, event, attachment, Career, CV, workspace, AI operation, notification, settings/provider and security-metadata JSON categories.
+- Owned attachment, CV upload, avatar, generated-CV and daily-export bytes are included only after managed-root/reparse-point checks. Missing or unsafe files produce manifest warnings rather than cross-root reads.
+- `manifest.json` records schema version, generated time, category/item counts, byte sizes and SHA-256 checksums for every included entry. `README.txt` explains formats, exclusions and retention limits.
+- Password/security/concurrency hashes, TOTP secrets, recovery/trusted-device hashes, session IDs, provider access/refresh tokens, IMAP passwords, operation leases, email payload hashes, global settings and data-protection keys are never serialized.
+- The Settings Backup tab presents the readable export separately from the application-key-encrypted operational backup and explains recent sign-in without weakening the API rule.
+- Temporary ZIPs live under an opaque owner root and are opened with delete-on-close when returned by the controller.
+
 ## Verification
 
-- Focused CV/export/controller/background tests: 77/77.
-- Full backend: 647/647.
+- Owner-storage focused CV/export/controller/background tests: 77/77.
+- Readable-export focused backend/API tests: 11/11, including real SQLite, two-owner isolation, file inclusion, every checksum and secret-redaction sentinels.
+- Full backend: 650/650.
+- Frontend export/Settings tests: 4/4; full frontend 58 suites/234 tests.
 - Backend build: pass, zero warnings/errors.
+- Optimized frontend build/TypeScript: pass.
+- Chromium: fresh Free account receives a real ZIP response with a `PK` signature and readable-export success state.
 - `git diff --check`: pass aside from line-ending notices.
 
 ## Remaining repository work
 
-1. Implement one owner inventory used by both readable ZIP export and deletion.
-2. Add manifest/checksums/warnings and include safely owned binary files without exposing storage paths.
-3. Add the additive deletion state/request/file schema and disabled coordinator.
-4. Add pending-account authentication/mutation gates, session/queue cancellation, provider cleanup and idempotent file quarantine/database purge.
-5. Add separate tombstone storage/replay and settings/admin UX while keeping production activation disabled.
+1. Reuse the completed owner inventory in the deletion coordinator.
+2. Add the additive deletion state/request/file schema and disabled coordinator.
+3. Add pending-account authentication/mutation gates, session/queue cancellation, provider cleanup and idempotent file quarantine/database purge.
+4. Add separate tombstone storage/replay and settings/admin UX while keeping production activation disabled.
 
 Production retention, legal hold and restored-backup decisions remain recorded in `BLOCKERS.md`.