Signed-in opt-out writes User.doNotSellAt

A verified session stores the request on the account. Admin can see it without inventing a timestamp.

When you are signed in, savePrivacyChoice writes User.doNotSellAt and an audit reason. Withdraw clears that timestamp.

GET /api/v1/privacy-choices then returns source account. The cookie may still be set as a backup for the same browser.