chore(work): decompose compliance-manifests epic

Generated 1 epic + 8 stories under docs/work/epics/ from the approved
PRD docs/work/prds/compliance-manifests-pii-retention-subprocessors.prd.md.
Stories cover type primitives, ESLint rule, ADR-022 amendment, retention
purge job, template backfill, three generator scripts, pre-commit + CI
integration, and docs/compliance/ reference files. Ready for
`pnpm work dispatch --execute` to begin implementation.

docs/work/epics/compliance-manifests-pii-retention-subprocessors/05-backfill-template-collections/_story.md

@@ -0,0 +1,47 @@
+---
+id: 05-backfill-template-collections
+epic: compliance-manifests-pii-retention-subprocessors
+title: Backfill existing template Payload collections with PII and retention metadata
+type: technical-story
+status: todo
+feature: auth
+depends-on:
+  [01-pii-retention-type-primitives, 02-eslint-rule-pii-declaration-complete]
+blocks: [06-compliance-generator-scripts]
+created: 2026-05-18T17:52:09Z
+updated: 2026-05-18T18:06:15.725Z
+---
+
+## Goal
+
+Add `custom.pii` + `custom.retention` to `auth.users` (full PII tagging), and `custom.retention` to the five remaining template collections (`blog.articles`, `marketing-pages.site-settings`, `marketing-pages.pages`, `media.media`, `navigation.header`), plus `custom.pii` on `media.media.uploadedBy` if the field exists. Each feature's collection file lands as its own commit.
+
+## Why
+
+The generators (Story 06) walk Payload configs to produce `compliance/*.yml`. Without backfill, the retention-policy generator warns every collection is missing `purgeSchedule`, and `data-map.yml` has no entries. The backfill also validates that the type primitives from Story 01 compile correctly in real collection files.
+
+## Done when
+
+- `auth.users`: `displayName` tagged `{ category: "identification-username", purpose: ["service-delivery"], exportable: true, restrictable: true }`. `custom.retention`: `postDeletion: { duration: "P30D", trigger: "after-deletion", action: "hard-delete" }`, `purgeSchedule: "daily"`. `PAYLOAD_AUTH_PII_DEFAULTS` covers `email`/`password`/`salt`/`hash` automatically — no `custom.authPii` override needed.
+- `blog.articles`: `custom.retention` with `purgeSchedule` declared.
+- `marketing-pages.site-settings` + `marketing-pages.pages`: `custom.retention` with `purgeSchedule` declared.
+- `media.media`: `custom.retention` with `purgeSchedule`; `uploadedBy` tagged `{ category: "identification-username", ... }` if the field exists in the collection.
+- `navigation.header`: `custom.retention` with `purgeSchedule` declared.
+- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass after each individual commit.
+
+## In scope
+
+- Payload collection config files within: `packages/auth/`, `packages/blog/`, `packages/marketing-pages/`, `packages/media/`, `packages/navigation/`.
+
+## Out of scope
+
+- PII tags on fields not clearly identified as PII in the PRD (template default is conservative).
+- Custom `authPii` overrides — not needed unless non-default auth fields are present.
+
+## Tasks
+
+- [ ] Add `custom.pii` (`displayName` as `identification-username`) + `custom.retention` (daily purge, 30-day post-deletion hard-delete) to `auth` feature's Payload users collection — `PAYLOAD_AUTH_PII_DEFAULTS` covers email/credentials — all gates pass on this commit.
+- [ ] Add `custom.retention` to `blog` feature's articles collection — all gates pass on this commit.
+- [ ] Add `custom.retention` to `marketing-pages` feature's site-settings and pages collections — all gates pass on this commit.
+- [ ] Add `custom.retention` (and `custom.pii` on `uploadedBy` if the field exists) to `media` feature's media collection — all gates pass on this commit.
+- [ ] Add `custom.retention` to `navigation` feature's header collection — all gates pass on this commit.