feat: add archive-backed retention

[salihdev0]

Summary

• add explicit, bounded retention policies outside the Trail hot path
• require verified gzip-NDJSON archives before deleting events or payloads
• support PostgreSQL and ClickHouse retention/catalog/restore operations
• add bounded idempotent restore through CLI and optional Explorer API routes
• document safe operation, dry runs, precedence, and payload GC

Safety

There is no delete-without-archive mode. Archive write, checksum verification, or catalog commit failure leaves live events untouched. Payload candidates without archive identity are never deleted.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• PostgreSQL archive → delete → restore smoke test
• ClickHouse archive → delete → restore smoke test