GDPR export/delete query the wrong GSI — right-to-erasure is non-functional

Severity: High · Where: data.ts:170-173,229-232; live writes at orm/index.ts:168,582 Export/delete query IndexName:'gsi1' with gsi1pk=VISITOR#{id}, but the live ORM writes gsi1pk=SITE#{siteId}#DATE#{date}. Export returns no rows; delete returns success:true, deletedCount:0. Also a casing inconsistency (lowercase gsi1 vs GSI1 elsewhere) → ValidationException if the table GSI is uppercase. Impact: GDPR erasure silently does nothing. Compliance-relevant. Fix: Query a visitor-keyed GSI (add one if needed) with consistent casing.