docs: document personal data, refresh tokens and regulatory reporting

[anoziere]

Three gaps found while going through the code of the 3.0 line: features that ship but are documented nowhere.

Personal data

A new page, security/personal-data.md, covering what a shop needs to answer a right of access or a right to erasure:

• customer:export-personal-data, with the five core sections it produces
• customer:anonymize, with the table of what is erased and what is kept, and why deleting the account is not the same thing
• CustomerPersonalDataProviderInterface, with a worked example, so a module declares the data it holds and is called on both the export and the anonymization
• the retention periods of maintenance:purge, including the two customer periods that are off by default on purpose
• how a module hooks its own purge onto MAINTENANCE_PURGE
• a short list of what Thelia does not provide, so nobody promises it: no cookie banner, no self-service account deletion, nothing exposed through the API

Three command pages go with it: customer:anonymize, customer:export-personal-data and maintenance:purge.

The CLI index also gains thelia:order:rounding-mode, sequence:set, import-export:clean and hook:clean, gets the outdated maintenance:purge description fixed, and now names thelia:cache:clear rather than Symfony's cache:clear.

Refresh tokens

api/authentication.md showed a login response with a single token, while the endpoints have been returning refresh_token and refresh_token_ttl for a while. The page now documents both refresh endpoints, the single-use rotation, the admin/front scoping, the response codes and JWT_REFRESH_TOKEN_TTL.

Regulatory reporting

docs/security/cra-incident-response.md in the main repository is complete but linked from nowhere and not published. security/security-policy.md now carries a section summarizing it: steward status under article 24, what triggers a notification, the ENISA channel, the 24 h / 72 h / 14 days timeline, and a link to the full process.

Versioning

Every change is applied to docs/ and to versioned_docs/version-3.0/, which are otherwise identical. security/ was missing entirely from the 3.0 snapshot, so the security policy page added in #47 was only visible under Next: it is now published in 3.0 as well.

npm run build passes, with no broken link or anchor on the pages touched.