DRY pass #2, batch 4, F13: the server's remaining pairs (#5372)

- common.detach: the hold-a-reference-until-done task start that mailer and
  unfurl_queue each wrote.
- common.expired_before: the retention window, now shared by trash and the
  audit log (it moves out of retention.py, which imports audit).
- responses.too_many: the 429 with Retry-After from the credential throttle
  and the client-download throttle.
- share_sync.revoke_lost: revoke whoever could see a note before and no
  longer can, after a share or a group goes.
- serialize.serialize_person: a member as the directory, a share and a
  group listing show them.
- groups_api._get_group: the path-id lookup four group routes wrote.
- settings.apply_session_ttl: the session lifetime set at boot and on save.

Kept: the attachment-id claim check (one query; each caller answers an id it
already holds differently), the strict UUID-list parses in reorder and
set_note_labels (distinct error messages), and the checklist-items loops
(one line each).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_retention.py

@@ -2,11 +2,11 @@ from datetime import datetime, timedelta, timezone
 
 import pytest
 
+from inkwell.common import expired_before
 from inkwell.retention import (
     SWEEP_BATCH,
     SWEEP_INTERVAL_SECONDS,
     SWEEP_STARTUP_DELAY_SECONDS,
-    expired_before,
     sweep_expired_trash,
 )
 from inkwell.settings import REGISTRY, get_public_config, validate_updates