chore(work): decompose dsr-consent-and-cookie-banner epic

Generated 1 epic + 11 stories under docs/work/epics/ from the approved
PRD docs/work/prds/dsr-consent-and-cookie-banner.prd.md. Stories cover
subject-linkage types, ADR-018 audit enum amendment, core-consent
foundation + impl + react, core-dsr (4 interfaces), core-api router
composition, core-ui scaffold + CookieConsentBanner, auth signup
migration, and documentation. Ready for `pnpm work dispatch --execute`.

docs/work/epics/dsr-consent-and-cookie-banner/_epic.md

@@ -0,0 +1,42 @@
+---
+id: dsr-consent-and-cookie-banner
+prd: docs/work/prds/dsr-consent-and-cookie-banner.prd.md
+title: DSR + consent abstraction + cookie consent banner — Epic B of ADR-025
+type: epic
+status: in-progress
+features:
+  [
+    core-shared,
+    core-consent,
+    core-dsr,
+    core-ui,
+    core-eslint,
+    core-testing,
+    core-api,
+    auth,
+  ]
+created: 2026-05-19T12:00:00Z
+updated: 2026-05-19T09:55:07.020Z
+---
+
+## Goal
+
+Ship the user-rights surface end-to-end: DSR endpoints that walk Epic A's PII tags to export/delete/rectify/restrict any subject's data, per-use-case consent gates with audit-logged proof, and a compliant cookie consent banner with EU-prominence defaults.
+
+## Why
+
+Epic A delivered declarative PII inventory + retention + sub-processors. Epic B closes the remaining gaps: GDPR Arts. 15–18 + 20 DSR endpoints, Art. 7 demonstrable consent with structural lint enforcement, and a CNIL-compliant cookie consent banner that downstream consumers can drop in without forking legal-compliance logic.
+
+## Stories
+
+- [ ] [01 — Subject-linkage types in core-shared](01-subject-linkage-types/_story.md)
+- [ ] [02 — Audit action enum amendment (ADR-018)](02-audit-enum-amendment/_story.md)
+- [ ] [03 — core-consent foundation: types + brand + withConsent + conformance + ESLint rule](03-core-consent-foundation/_story.md)
+- [ ] [04 — core-consent implementation: Payload impl + DI + migration helpers + tRPC router](04-core-consent-implementation/_story.md)
+- [ ] [05 — core-consent React subpath: ConsentProvider + useConsent()](05-core-consent-react/_story.md)
+- [ ] [06 — core-dsr: scaffold + interfaces + Payload impls + handlers + dsrRouter](06-core-dsr/_story.md)
+- [ ] [07 — core-api router composition: dsrRouter + consentRouter into appRouter](07-core-api-router-composition/_story.md)
+- [ ] [08 — core-ui scaffold](08-core-ui-scaffold/_story.md)
+- [ ] [09 — CookieConsentBanner component in core-ui](09-cookie-consent-banner/_story.md)
+- [ ] [10 — auth signUp anonymous consent migration](10-auth-signup-migration/_story.md)
+- [ ] [11 — Documentation: DSR guide + consent guide + glossary + CLAUDE.md](11-documentation/_story.md)