feat: implement payroll PII masking, data privacy, and GDPR/CCPA consent engine (closes #1870)

[Aakif-Kohari]

Description

This PR implements a Payroll PII Masking, Data Privacy & GDPR/CCPA Consent Engine. It introduces schemas for privacy consents, field-level masking rules, data erasure requests, and immutable PII access audit logs. The engine dynamically masks outgoing payroll data (e.g., SSNs, bank accounts) based on the requesting user's RBAC permissions. A "Data Erasure Guardrail" safely anonymizes a terminated employee's PII across historical ledgers while preserving the immutable financial/tax aggregation data required by the IRS 7-year retention mandate. The frontend allows Compliance Admins to configure masking rules, process GDPR erasure requests, and audit PII access.

Fixes#1870

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Changes Made

• backend/src/models/dataPrivacy.model.js (New): Schemas for PrivacyConsent, PIIMaskingRule, DataErasureRequest, and DataAuditLog.
• backend/src/utils/piiMaskingEngine.utils.js (New): Engine for dynamic RBAC masking and safe GDPR erasure logic.
• backend/src/controllers/dataPrivacy.controller.js (New): Endpoints for masking rules, consent tracking, and erasure processing.
• backend/src/routes/dataPrivacy.routes.js (New): Route definitions.
• frontend/src/pages/DataPrivacyDashboard.jsx (New): UI to manage masking rules, process erasure requests, and view audit logs.

How Has This Been Tested?

• Tested locally on frontend
• Tested locally on backend

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings

[vercel]

@Aakif-Kohari is attempting to deploy a commit to the Dev's projects Team on Vercel.

A member of the Team first needs to authorize it.