GDPR batch A+B: SECURITY.md, /privacy, rate limit, temp-file fix, Delete All Data

[roznet]

Works through Batches A and B of the outstanding items in legal/GDPR.md.

Backend

• Rate limit: /generate + /prefill share a limit of 100 fills per user per rolling hour, counted over the existing usage log (the same approach as flyfun_common.auth.rate_limit). Over the limit: 429 + Retry-After. Skipped in dev mode. Closes SECURITY_AUDIT.md §17.
• GET /privacy: public HTML rendered from the repo's PRIVACY.md (now copied into the image; new markdown dependency). Repo-relative links are rewritten to GitHub; a test guards the #passengers anchor that the in-app note links to.
• SECURITY.md: private reporting channel + UK GDPR Art. 33–34 breach runbook. GitHub private vulnerability reporting has been enabled on the repo.

iOS / macOS

• Temp-file regression fixed (SECURITY_AUDIT.md §16 had wrongly said FIXED since 6d5d0cc): GeneratedFormFiles owns tmp/forms/. iOS deletes the file on share-sheet close, or once the mail composer has the attachment. macOS keeps it after Open/Reveal/Mail/sharing services, then deletes it in the 15-minute sweep or at launch.
• Settings → Privacy: policy link and a passenger privacy note (share sheet, GDPR Art. 14).
• Delete All Data: every AppSchema model is deleted record by record, so CloudKit syncs the deletion (the confirmation says so); then the UI is rebuilt. Doesn't sign out.
• Delete Account wording now says that on-device records stay.
• New strings in fr/de/es are marked needs_review.

Android

• Same Privacy card, passenger note (the backup rules were checked, so "not backed up or synced" is true) and Delete all data: Room clearAllTables + the forms/export cache + WebView storage.

Docs

• PRIVACY.md: Android storage, passport scanning with the ML Kit metrics disclosure (Google's terms require it and document no opt-out), Passengers, and Deleting Your Data.
• legal/GDPR.md: new §6a for Android; §1/§7/§9/§15 resolved.
• designs/api.md and designs/ios-app.md updated.

Verification

• Python: 211 passed.
• iOS unit: 137 passed. macOS unit: 133 passed. iOS sim + macOS builds succeed.
• Android: JVM tests 27 + 116 passed; instrumented data tests 22/22 on an emulator.
• Not run: XCUI journeys; the new Settings UI hasn't been checked visually on any platform.

Before release

• Deploy is a Docker rebuild (new dependency + PRIVACY.md in the image). Deploy before the app releases, since they link /privacy.
• Play Console Data safety: declare ML Kit's diagnostics and device identifier as collected by an SDK.

🤖 Generated with Claude Code

[roznet]

Added feat(android): start ML Kit on first scan, not at app launch: removes ML Kit's MlKitInitProvider from the merged manifest and initialises ML Kit in MrzScanner, so pilots who never scan never run ML Kit or send Google its metrics. The new instrumented MlKitLazyInitTest passes (1/1) and was checked to fail with the provider restored; data tests still pass (22/22). The disclosure in PRIVACY.md and GDPR.md §6a is narrowed to match. Not checked: a real passport scan (the emulator has no MRZ to read), so a device scan before release is worth doing.

🤖 Generated with Claude Code

[roznet]

Rebased onto main (6 new Android commits from PR 35). Two things came out of it:

• ImageMrzReader (scan from photo/PDF, new on main) called ML Kit directly. With the startup provider removed, it would have crashed with "MlKitContext has not been initialized". Both scan paths now go through one startMlKit().
• MlKit.initialize() is not idempotent: a second call throws "already initialized". The earlier version of the lazy-init commit would have crashed the second scan in a session. startMlKit() now guards it to once per process. MlKitLazyInitTest runs each scan path twice and passes; before the fix it failed with exactly that exception.

The ML Kit commit was amended to include both fixes (force-pushed). Checks after the rebase: Android build, JVM tests, instrumented scan 1/1 and data 23/23, Python 211 passed.

🤖 Generated with Claude Code

[claude]

Code Review

Reviewed the full diff (Python API, iOS/macOS, Android) against designs/api.md and designs/ios-app.md.

Checked closely:

• rate_limit.py — sliding-window count over usage rows, shared by /generate + /prefill, dev-mode bypass, 429 + Retry-After. Logic and window math check out; matches the design doc and SECURITY_AUDIT.md §17.
• privacy.py — path resolution (parents[3]) lines up with the Dockerfile's COPY PRIVACY.md . into /app; anchor (#passengers) and link-rewriting are covered by tests.
• iOS GeneratedFormFiles/LocalDataEraser — directory-scoped delete-safety (path traversal, "outside root" guards), the sweep/removeAll lifecycle, and the macOS keepFile handoff logic (Open/Reveal/Mail vs Done/Save) are internally consistent and match the documented per-platform cleanup behavior.
• Android MlKitStart/ImageMrzReader/MrzScanner — double-checked-locking guard around the non-idempotent MlKit.initialize, both scan entry points call it first; LocalDataEraser erase order (DB → files → best-effort WebView clear) matches its own doc comment.

No bugs, CLAUDE.md violations (none present in repo), or design-doc deviations found with high confidence. Design docs (api.md, ios-app.md) and legal/GDPR.md/SECURITY_AUDIT.md were updated consistently with the code changes.

Approving.

🤖 Generated with Claude Code