feat(iios): DSR right-to-erasure (redact-in-place) + compliance hold (P9)

Adds IiosComplianceHold + IiosSourceHandle.redactedAt and a DsrService whose
eraseSubject redacts the caller's PII in place (message bodies, identity
display, raw payloads, support/inbox/transcript text) while preserving
externalId (source preservation), structure, and the audit trail. An active
compliance hold blocks erasure until released; every op is audited and
tenant-fenced. Erasure is idempotent (KG-03).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/app.module.ts

@@ -15,6 +15,7 @@ import { RoutingModule } from './routing/routing.module';
 import { AiModule } from './ai/ai.module';
 import { CalendarModule } from './calendar/calendar.module';
 import { CapabilityModule } from './capability/capability.module';
+import { DsrModule } from './dsr/dsr.module';
 import { HealthController } from './health.controller';
 import { MetricsController } from './observability/metrics.controller';
 import { DevController } from './dev/dev.controller';
@@ -37,6 +38,7 @@ import { DevController } from './dev/dev.controller';
     AiModule,
     CalendarModule,
     CapabilityModule,
+    DsrModule,
   ],
   controllers: [HealthController, MetricsController, DevController],
 })