feat(auth): add PII and retention metadata to users collection

Tag displayName as identification-username PII and declare daily purge
with 30-day post-deletion hard-delete retention. PAYLOAD_AUTH_PII_DEFAULTS
covers email/credentials automatically — no authPii override needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,6 +1,6 @@
 {
-  "generatedAt": "2026-05-18T18:55:54.185Z",
-  "commit": "d326270",
+  "generatedAt": "2026-05-18T19:03:46.644Z",
+  "commit": "464df9a",
   "repo": {
     "statements": 96.43,
     "branches": 91.71,

packages/auth/src/integrations/cms/collections/users.ts

@@ -6,10 +6,28 @@ export const users: CollectionConfig = {
   admin: {
     useAsTitle: "email",
   },
+  custom: {
+    retention: {
+      purgeSchedule: "daily",
+      postDeletion: {
+        duration: "P30D",
+        trigger: "after-deletion",
+        action: "hard-delete",
+      },
+    },
+  },
   fields: [
     {
       name: "displayName",
       type: "text",
+      custom: {
+        pii: {
+          category: "identification-username",
+          purpose: ["service-delivery"],
+          exportable: true,
+          restrictable: true,
+        },
+      },
     },
     {
       name: "role",