fix(gdpr): address PR review feedback for validation and documentation

Address code review feedback from PR #252:

- ConsentRequestDto: Change regex pattern from * to + to prevent empty
  strings from passing validation for custom consent types

- GdprDeletionService: Capture user email at start of executeUserDeletion()
  before entity deletion to avoid potential entity lifecycle issues when
  publishing UserDeletedEvent

- FileAuditLogQueryService: Enhance JavaDoc with detailed performance
  warning about file-scanning limitations (<50MB, <100K events) and
  recommendations for high-volume production deployments

Author: devondragon

src/main/java/com/digitalsanctuary/spring/user/audit/FileAuditLogQueryService.java

@@ -26,8 +26,19 @@
  *
  * <p>This implementation reads and parses the entire log file for each query,
  * filtering results by user email or ID. While suitable for small to medium
- * audit volumes, applications with high audit volumes should consider implementing
- * a database-backed query service.
+ * audit volumes (&lt;50MB, &lt;100K events), applications with high audit volumes
+ * or frequent export requests should consider implementing a database-backed
+ * query service for better performance.
+ *
+ * <p><strong>Performance Note:</strong> GDPR export operations call this service
+ * multiple times (findByUser, findByUserAndAction) which results in reading
+ * and parsing the entire log file for each call. For production deployments
+ * with large audit logs, consider:
+ * <ul>
+ *   <li>Implementing a database-backed {@link AuditLogQueryService}</li>
+ *   <li>Adding log rotation to keep file sizes manageable</li>
+ *   <li>Using indexed storage for audit events</li>
+ * </ul>
  *
  * <p>The log file format is:
  * {@code Date|Action|ActionStatus|UserId|Email|IPAddress|SessionId|Message|UserAgent|ExtraData}

src/main/java/com/digitalsanctuary/spring/user/dto/ConsentRequestDto.java

@@ -33,7 +33,7 @@ public class ConsentRequestDto {
      * Must contain only alphanumeric characters, underscores, and hyphens.
      */
     @Size(max = 100, message = "Custom type must not exceed 100 characters")
-    @Pattern(regexp = "^[a-zA-Z0-9_-]*$", message = "Custom type can only contain letters, numbers, underscores, and hyphens")
+    @Pattern(regexp = "^[a-zA-Z0-9_-]+$", message = "Custom type can only contain letters, numbers, underscores, and hyphens")
     private String customType;
 
     /**

src/main/java/com/digitalsanctuary/spring/user/gdpr/GdprDeletionService.java

@@ -150,6 +150,7 @@ public DeletionResult deleteUser(User user, boolean exportBeforeDeletion) {
     @Transactional
     protected DeletionResult executeUserDeletion(User user, GdprExportDTO exportedData, boolean wasExported) {
         Long userId = user.getId();
+        String userEmail = user.getEmail();
 
         // Step 2: Notify all GdprDataContributors to prepare for deletion
         prepareContributorsForDeletion(user);
@@ -168,7 +169,7 @@ protected DeletionResult executeUserDeletion(User user, GdprExportDTO exportedDa
         log.info("GdprDeletionService.deleteUser: Successfully deleted user {}", userId);
 
         // Step 6: Publish UserDeletedEvent after successful deletion
-        eventPublisher.publishEvent(new UserDeletedEvent(this, userId, user.getEmail(), wasExported));
+        eventPublisher.publishEvent(new UserDeletedEvent(this, userId, userEmail, wasExported));
 
         return wasExported
                 ? DeletionResult.successWithExport(exportedData)