feat(retention): every growing table is pruned; the audit log has its own window; charts read the raw window from Settings (#5155)

- prune_by_age(column) registers a time-series column with the hourly cleanup;
  Traefik (metrics, access summaries, global stats) and UniFi (WAN, client,
  WLAN, DPI, events, alarms, speedtests) register theirs in setup().
- Alert events join monitor results and Ansible runs on data.retention_days,
  read from Settings each run; Ansible run log files older than it are deleted.
- audit.retention_days (365) keeps the audit log longer, set on Settings > General.
- metric_series.points reads metrics.retention.raw_days, so the chart's
  raw/rollup seam is where the rollup put it (RAW_DAYS removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/settings.py

@@ -47,7 +47,11 @@ DEFAULTS: dict[str, Any] = {
     # Failed logins from one address before it is refused for the window.
     "login.max_failures": 5,
     "login.lockout_minutes": 15,
+    # Every growing time-series table (monitor results, Ansible runs and their
+    # log files, alert history, Traefik and UniFi samples) keeps this many days.
     "data.retention_days": 90,
+    # The audit log is a security record: kept longer than operational data.
+    "audit.retention_days": 365,
     "monitors.poll_interval_seconds": 60,
     "smtp.host": "",
     "smtp.port": 587,