feat(training): separate opt-in contribution receipts with withdrawable tombstones

A journal save now records no training contribution. A contribution is a second
consent: the privacy page states consent version training-consent-v1 and the
receipt (contribution id, included fields, never-included fields) before the
confirm control is enabled, the receipt is queued on this device only and copies
no photo bytes, note text, or symptom answers, and withdrawal keeps a tombstone
naming every derived artifact by contribution id. Delete-all clears the receipts
with the ledger.

Closes #24

.gitea/workflows/quality.yml

@@ -59,6 +59,7 @@ jobs:
           npm run test:worker-readiness
           npm run test:pattern-summary
           npm run test:photo-lifecycle
+          npm run test:training-contribution
       - name: Dependency audit
         run: npm audit --audit-level=high
       - name: Syntax checks