Add automatic retention purging for the Diagnostic and Audit logs

The diagnostic log already rings-buffer to 500 rows, but the audit
log had no cap at all and would grow forever. Adds an opt-in
age-based purge under Settings -> Logs: keep entries for N days,
checked on a configurable interval (hourly through monthly), plus a
manual "Purge now" button. Reuses the existing node-schedule-style
reschedule-on-settings-change pattern from the secret/Tailscale
expiry checkers, but as a plain setInterval since "how often" here is
an interval rather than a specific daily time.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/api/client.ts

@@ -153,6 +153,12 @@ export interface DisplaySettings {
   pageSize: number;
 }
 
+export interface LogRetentionSettings {
+  enabled: boolean;
+  retentionDays: number;
+  intervalHours: number;
+}
+
 export interface AppSettings {
   gotify: GotifySettings;
   ntfy: NtfySettings;
@@ -162,6 +168,7 @@ export interface AppSettings {
   providerColors: Record<string, string>;
   integrationColors: Record<string, string>;
   display: DisplaySettings;
+  logRetention: LogRetentionSettings;
 }
 
 export type AppSettingsPatch = { [K in keyof AppSettings]?: Partial<AppSettings[K]> };
@@ -792,5 +799,7 @@ export const api = {
       request<{ ok: true }>("/api/settings/test-smtp", { method: "POST", body: JSON.stringify(data) }),
     testWebhook: (data: { url: string; secret?: string }) =>
       request<{ ok: true }>("/api/settings/test-webhook", { method: "POST", body: JSON.stringify(data) }),
+    purgeLogs: () =>
+      request<{ diagDeleted: number; auditDeleted: number }>("/api/settings/purge-logs", { method: "POST" }),
   },
 };