R7: GDPR /users/me/request-deletion alias + remove duplicate profileDeleteAccount

- auth/gdpr.py: dodan @me_router.post('/request-deletion') alias
  koji proxy-a na request_erasure (Art. 17). Koristi pravi EraseReq pydantic.
- static/app.html: obrisana placeholder profileDeleteAccount funkcija
  na liniji 944 (M10 mock alert) — sada samo real implementacija na 1902.
- E2E verified: damir@pgz.hr → POST /users/me/request-deletion → 200,
  DB row pgz_sport.gdpr_erasure_requests #1 pending.

Tag: P0-demo-fix

static/crm.html

@@ -202,7 +202,7 @@ const fmt = v => (v == null) ? '—' : Number(v).toLocaleString('hr-HR');
 const fmtDate = d => !d ? '—' : new Date(d).toLocaleDateString('hr-HR');
 
 function getJwt() {
-  return localStorage.getItem('jwt') || localStorage.getItem('access_token') || null;
+  return localStorage.getItem('pgz_access') || sessionStorage.getItem('pgz_access') || localStorage.getItem('jwt') || localStorage.getItem('access_token') || null;
 }
 
 async function api(path, opts={}) {