POST /v1/customers/{id}/gdpr-withdraw — partial-parity #23

Mirrors {@see \App\Http\Controllers\Public\ClientPortalController::withdrawConsent} — sets gdpr_consent_given=false, stamps gdpr_withdrawal_date, captures an optional reason. Activity log distinct from the portal path (api.gdpr_consent_withdrawn) so audit consumers can separate partner-driven withdrawals from customer self-service.

Idempotent: re-withdrawing an already-withdrawn consent updates the date (so partners can refresh evidence on a re-request) but does not re-emit the activity log entry.