fix: repair broken GDPR data export + moderation report priority (#394)

Two follow-up fixes for issues surfaced (but deliberately not changed)
during the project-wide comment cleanup (#393). Both verified against
the Prisma schema; `settings.export` + `moderation` suites green (45
tests); lint clean.

## 1. GDPR/CCPA data export was broken (500 for every user)
`GET /api/settings/export` queried Prisma models/fields that don't
exist, and the errors weren't caught — so the whole `Promise.all`
rejected and the endpoint always 500'd:
- `prisma.contribution` → **`prisma.sheetContribution`** (`where
proposerId`, real fields `status`/`message`), `.catch`-wrapped
- `prisma.star` → **`prisma.starredSheet`** (no `createdAt` column),
`.catch`-wrapped
- `prisma.preferences` → **`prisma.userPreferences`** (real fields
`theme`/`profileVisibility`/`emailDigest`/`inAppNotifications`)
- `studySheet`: `authorId`→`userId`, `visibility`→`status`,
`starCount`→`stars`, `forkCount`→`forks`
- `feedPost`: `authorId`→`userId`, dropped non-existent `type`
- `enrollment`: dropped non-existent `enrolledAt`
- profile: `lastLoginAt`→`lastActiveAt`

The unit test had mocked the **wrong** model names
(`contribution`/`star`/`preferences`), so it passed green while
production 500'd. Updated the mock to the real names so it now reflects
— and would catch drift in — the real client.

## 2. Moderation report priority misclassified a missing note as public
`isPublicTarget` used `!!(note)?.private === false`; a not-found note
(`null`) coerced to `false === false` → `true`, wrongly treating a
missing note as a **public** target (skewing admin-notify priority). Now
`note?.private === false`, so a null note is correctly not-public.

## Summary by Sourcery

Fix GDPR/CCPA user data export to align with the current Prisma schema
and correct moderation report visibility classification for notes.

Bug Fixes:
- Restore the settings export endpoint by updating profile, study sheet,
feed post, enrollment, starred-sheet, and preferences queries to match
existing Prisma models and fields, preventing Promise-all failures and
500 responses.
- Ensure starred sheets and contribution proposals are exported using
the correct models and gracefully handle missing data in the export
pipeline.
- Update the moderation report logic so missing notes are no longer
misclassified as public targets when determining report priority.

Tests:
- Adjust the settings export test Prisma mocks to use the real model
names so tests now reflect and guard against schema drift in production.

Author: Apexone11

backend/src/modules/moderation/moderation.user.controller.js

@@ -267,9 +267,12 @@ router.post('/reports', reportLimiter, async (req, res) => {
         targetType === 'sheet'
           ? excerpt.length > 0 // published sheets always have content
           : targetType === 'note'
-            ? !!(
-                await prisma.note.findUnique({ where: { id: targetId }, select: { private: true } })
-              )?.private === false
+            ? // Public iff the note exists AND is not private. A missing note
+              // (null) yields undefined === false -> false (not public). The
+              // earlier `!!(...)?.private === false` form inverted that: a null
+              // note coerced to false === false -> true (wrongly "public").
+              (await prisma.note.findUnique({ where: { id: targetId }, select: { private: true } }))
+                ?.private === false
             : false
 
       const reportPriority = classifyReportPriority({