Export the caller's own data as JSON (GDPR portability)

Every token row the account owns, personal and OAuth alike; kind and clientId say which application an OAuth row was minted for. Never a secret.

Events the caller themselves actored, oldest first, limited to what is still on the ledger (older activity ages out) and to boards the caller can read today. Another member's events are never here.