feat(saas): Phase 3 — plan/seats/active model, ToS consent, signed expiring export

P3a: org carries plan/seats/active/created_at; create_user enforces seats + rejects
inactive org; verify blocks login for inactive orgs; PATCH /api/admin/orgs (super_admin)
updates plan/seats/active with audit. Fixed verify swallowing its AuthError.
P3b: export/token issues a 5-min HMAC one-time CSV link; export accepts ?token=.
P3c: setup requires accepted_terms (consent stored); Setup.vue consent checkbox.
All 8 backend suites pass. Rebuilt dist.

backend/app/api/auth_routes.py

@@ -62,10 +62,14 @@ def setup():
     username = (data.get("username") or user.get("username") or user.get("id") or "").strip().lower()
     email = (data.get("email") or "").strip()
     new_password = data.get("password") or ""
+    # SaaS: consent to Terms/Privacy is required before use.
+    if not data.get("accepted_terms"):
+        raise ApiError("you must accept the Terms of Service and Privacy Policy to continue", 400)
     if not email or not new_password:
         raise ApiError("email and new password are required")
     try:
         updated = _store().complete_setup(username, email, new_password)
+        _store().users.update(_store()._norm(username), accepted_terms=True, accepted_terms_at=__import__("time").strftime("%Y-%m-%dT%H:%M:%SZ"))
     except AuthError as exc:
         raise ApiError(str(exc), 400)
     return jsonify({