Bug: GDPR delete fails — method mismatch (UI DELETE vs route POST) + missing visitorId

Problem: SettingsTab calls DELETE but the route is POST, and no visitorId is sent → 405/400 (audit: src/handlers/data.ts handleGdprDelete).

Fix: align method + collect the visitor id in the UI.

Done when: a GDPR delete request actually purges the visitor.