feat(web): send CSA Vercel protection bypass on GDPR scrub

[kilo-code-bot]

Summary

Cloud → CSA POST /api/internal/cloud/users/gdpr-scrub was getting csa_unauthorized because Vercel Deployment Protection runs before CSA's KILO_SUPPORT_API_SECRET check. CSA → Cloud working does not cover this path.

• Send x-vercel-protection-bypass from CSA_VERCEL_PROTECTION_BYPASS (header only, never a query param).
• Keep Authorization: Bearer $SUPPORT_API_SECRET for CSA route auth.
• Update the csa_unauthorized operator hint to mention both secrets.

After merge, set the secret with pnpm web:env set CSA_VERCEL_PROTECTION_BYPASS (CSA project's Vercel automation bypass).

Verification

• oxfmt on changed files
• git diff --check
• oxlint on changed deletion-queue files: clean
• Jest for csa-support-db / deletion-hints not run here (no local Postgres)

Visual Changes

None. Operator hint text for csa_unauthorized now mentions CSA_VERCEL_PROTECTION_BYPASS.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• .env.local.example
• ENVIRONMENT.md
• apps/web/src/lib/user/deletion-queue/deletion-hints.test.ts
• apps/web/src/lib/user/deletion-queue/deletion-hints.ts
• apps/web/src/lib/user/deletion-queue/handlers/csa-support-db.test.ts
• apps/web/src/lib/user/deletion-queue/handlers/csa-support-db.ts

---

_{Reviewed by grok-4.6 · Input: 58.6K · Output: 9.9K · Cached: 514.2K}

_{Review guidance: REVIEW.md from base branch main}