Add personal data exporter and eraser

[faisalahammad]

What?

Registers the plugin with the WordPress personal data export and erasure tools (Tools > Export Personal Data and Tools > Erase Personal Data). Users can request a copy of their two-factor data, and site admins can clear login artifacts for a user.

Fixes #954

Why?

The plugin stores per-user authentication data (enabled methods, failed login counters, one-time tokens, TOTP replay markers) but hooks into neither privacy tool. None of it shows up in a personal data export, and none of it is removed on erasure, so sites honoring data requests have to clean up user meta by hand.

How?

• Two_Factor_Core registers the wp_privacy_personal_data_exporters and wp_privacy_personal_data_erasers filters and implements both callbacks. The export is one "Two Factor Authentication" group with the enabled methods, primary method, failed login attempts, and the last failed login time.
• Providers contribute their own data through two optional methods on Two_Factor_Provider, mirroring the existing uninstall_user_meta_keys() pattern:
  • privacy_export_data( $user ) returns display rows: TOTP shows "Configured" plus the last successful login, Email shows when a code was last sent, Backup Codes shows the remaining code count. Third-party providers get the same extension path without core knowing their meta keys.
  • privacy_eraser_user_meta_keys() lists the short-lived keys each provider wants erased.
• The eraser deletes short-lived records (login nonce, rate limit counters, failed attempt count, password reset flag, email token and its timestamp, TOTP last successful login) and deliberately keeps credentials (TOTP secret, backup code hashes, enabled and primary provider). Retained items are reported via items_retained with a message explaining they are removed when the account itself is deleted, so erasure cannot silently strip the second factor from a live account.
• Exports never include secret material: the TOTP key, hashed email tokens, and backup codes are verified absent from the payload by dedicated tests.

Testing Instructions

Automated: npm test runs the new PHPUnit tests covering the export contents, the erasure behavior, and that no secret material appears in the export payload.

Manual:

1. Build and start the dev environment: npm install && npm run build && npm run env start.
2. Edit a test user and enable Email, TOTP, and Backup Codes under "Two-Factor Options".
3. Generate a backup code set and configure TOTP so all three providers have data.
4. Go to Tools > Export Personal Data, enter the test user's email, and run the export. The download contains a "Two Factor Authentication" group listing the enabled methods, the primary method, failed login attempts, the TOTP status with last successful login, the email code send time, and the remaining backup code count. No TOTP secret, tokens, or codes appear anywhere in the file.
5. Go to Tools > Erase Personal Data, enter the same email, and run erasure. The result shows removed and retained counts, with a message that credentials were kept.
6. Confirm the test user can still log in with the existing TOTP secret and backup codes, and that any in-flight 2FA prompt was invalidated by the erasure.
7. Delete the test user and confirm the remaining two-factor user meta goes with the account.

Changelog Entry

Added - Register a personal data exporter and eraser with the WordPress privacy tools.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faisalahammad <faisalahammad@git.wordpress.org>
Co-authored-by: dknauss <dpknauss@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.