Delete Consumer Endpoint

Consumer right-to-delete: purge all credentials, pseudonyms, conversions, and anonymize audit logs.

H1 hardening: this is a DESTRUCTIVE, irreversible purge, so it accepts ONLY a verified access token as proof of identity. The old x-consumer-id header / JSON-body consumer_id fallback is REMOVED as an AUTHORIZATION path — it let anyone purge any consumer by guessing or reading their id, with no proof of ownership whatsoever. A caller can only ever purge the subject its own verified token names; a body-supplied id, if present, is checked but never trusted alone.