Expire trash after 30 days, and make the deadline something you can see

Trash had no end. A note sat in /trash until someone emptied it by hand, and
its attachment BYTES sat on disk the whole time — the pile-up the operator
asked about. Nothing purged; there was no scheduler at all.

Retention is server-owned: `trash_retention_days` (default 30, 0 = keep
forever) in the settings registry, so it lands in admin Settings with no
migration and takes effect without a restart. A background sweep started in
before_serving does the work. Clients learn about a purge the way they learn
about any deletion — as a tombstone on the delta feed.

An auto-purge nobody can see coming is data loss on a timer, so the window is
now visible: /api/config publishes it, notes carry `deleted_at`, Trash leads
with the policy, and each card counts down. The countdown rounds DOWN — saying
"1 day left" for a note with ten minutes on the clock is the one error here
that actually costs someone a note.

Three things this turned up on the way:

- `DELETE /api/notes/<id>` hard-deleted the row, leaving no tombstone at all.
  A permanent delete in the web UI never reached a linked device, which would
  keep its copy forever and push it back on the next edit. It now purges
  through the same path as everything else.
- The purge left `note_revisions` and `note_link_previews` behind. A revision
  holds the full body, so the text of a "permanently deleted" note was still
  sitting in the database.
- `deleted_at` now SURVIVES a purge instead of being cleared. It's still true,
  and it means every query that says "not trashed" excludes tombstones for
  free — without it a content-less row reads as a perfectly normal active note
  and shows up on the board as a blank card.

Desktop keeps its own clock only when there's nobody else to keep one: the
sweep runs at startup on an UNLINKED device and refuses otherwise. A linked
client that expired notes on its own schedule could destroy something the
server was deliberately keeping, then push that delete upstream. Local policy
must never outrank the server's — so it also adopts the server's window for
the countdown rather than showing its offline default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

src/thoughtsync/app.py

@@ -1,8 +1,10 @@
 from __future__ import annotations
 
+import asyncio
 import mimetypes
 import os
 import secrets
+from contextlib import suppress
 from datetime import timedelta
 
 from quart import Quart, has_request_context, jsonify, request, send_from_directory
@@ -15,6 +17,7 @@ from .db import session_scope
 from .graph import bp as graph_bp
 from .labels import bp as labels_bp
 from .notes import bp as notes_bp
+from .retention import run_sweeper
 from .saved_filters import bp as saved_filters_bp
 from .settings import get_public_config, get_setting, load_or_create_secret_key
 from .settings_api import bp as settings_bp
@@ -80,6 +83,21 @@ def create_app() -> Quart:
                 app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(days=days)
             except (ValueError, TypeError, KeyError):
                 pass
+        # Expire old trash in the background (retention.py). One task per process is
+        # correct because the image serves with a single hypercorn worker (Dockerfile);
+        # if that ever gains `--workers`, this needs a lock so N workers don't each
+        # sweep. Duplicate sweeps would be harmless but wasteful — a purged row is
+        # skipped by `purged_at IS NULL` — so this is about load, not correctness.
+        app.config["TRASH_SWEEPER"] = asyncio.create_task(run_sweeper())
+
+    @app.after_serving
+    async def _shutdown() -> None:
+        task = app.config.get("TRASH_SWEEPER")
+        if task is not None:
+            task.cancel()
+            # Await the cancellation so shutdown doesn't race a sweep mid-transaction.
+            with suppress(asyncio.CancelledError):
+                await task
 
     @app.get("/api/health")
     async def health():