fix: minimize verifier contact-data retention on current main

[mergemaven11]

Closes #187.

Supersedes stale draft PR #194. This replacement reapplies the verifier privacy lifecycle work directly onto current protected main and fixes the CI-discovered migration regressions without weakening retention behavior.

What changed

• Store pending verifier email/message/token hash in dedicated receipt_verification_requests records instead of Impact Receipt confirmation arrays.
• Add unique pending-request and TTL expiry indexes.
• Delete pending contact payloads after confirm/decline and treat expired requests as unavailable immediately.
• Add an idempotent migration/runbook for legacy records.
• Update verification email, Privacy Policy, and Terms disclosures.
• Normalize Mongo/BSON timezone-naive UTC readback in the migration regression test.
• Make repeat migration runs recognize already-minimized pending confirmations by their valid backing request record instead of incorrectly deleting them as orphans.

CI regressions addressed

The old PR initially passed 166/167 backend tests; its sole failure was a timezone-aware vs timezone-naive UTC assertion. After correcting that assertion, CI exposed a real idempotence defect: the second migration run treated intentionally removed legacy contact fields as missing source data. The migration now validates the separate active request record and preserves the minimized confirmation on repeat runs.

A subsequent Frontend CI failure was isolated to the existing full-page Chrome target-detach race in the real-click audit, not this privacy change. That blocker was fixed and merged independently in #207 after Backend, Frontend, and Security CI passed on its exact head. This branch is now refreshed onto the #207 main; its current exact head must independently pass all required checks before merge.

Merge gate

Merge only if Backend CI, Frontend CI, and Security CI are green on this exact current head, the PR remains current/mergeable, and review threads are resolved.