Consent ledger

Matching uses current consent, not old answers.

Every matching surface should resolve the latest decision per purpose. Revoked consent stays visible as a ledger event, but it must stop personalisation or discovery behaviour immediately.