Document data access layer contracts and security model

Write the documentation as a Markdown file at docs/data-access-layer.md. Structure it with the following top-level sections: Overview, StatsRepository API Reference, StatsCacheManager Reference, RoleAccessValidator Reference, Database Views and Indexes, Dual-Layer Security Model, GDPR Compliance, Sequence Diagrams, and Changelog. Use Mermaid sequenceDiagram blocks for the three diagrams — they render natively in GitHub and most documentation platforms. For the GDPR section, focus on: (a) which fields constitute personal data (coordinator ID, peer mentor name, activity notes), (b) that queries return only aggregated or role-scoped data, (c) that raw activity notes are never returned in stats queries, and (d) that Blindeforbundet has stricter requirements around epikrise data that must never intersect with the stats layer.

Verify all exception type names by running grep -r 'class Stats.*Exception' lib/ before writing.

Documentation quality is verified through a peer review checklist: (1) every public API method in StatsRepository has a corresponding entry in the docs, (2) all exception class names match grep output against the Dart source, (3) all three sequence diagrams render without errors in a Mermaid previewer, (4) GDPR section is reviewed by a team member with knowledge of Norwegian GDPR obligations. No automated test suite is required for documentation, but the review checklist must be completed and signed off before the task is closed.