A signed-in account can export all of its own data — profile, a list of
its memberships/grants, and the Markdown of its personal pond plus the
shared ponds it owns — as one ZIP. Foreign content never appears: only
owned ponds are bundled and the per-page read filter (reused from #65)
runs for each.
- Reuse the conversion-job queue as the async carrier: a `data_export`
job whose worker branch resolves DataExportService via a token (no DI
cycle), builds the ZIP, and stores it with an `expiresAt`. The download
link 404s past expiry and an hourly scheduled purge drops the bytes
(data minimization, security.md §Privacy).
- Extract ExportService.appendPondMarkdown so the pond ZIP (#65) and the
data export share one read-filtered pond archiver.
- Rate-limit requests per account (RateLimitService); POST
/users/me/data-export enqueues, GET /jobs/:id(/result) poll/download.
- Settings UI "Export my data" (de+en); web share pollJob/downloadJobResult
between the document and data export hooks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
