Expire trash after 30 days, and make the deadline something you can see

Trash had no end. A note sat in /trash until someone emptied it by hand, and
its attachment BYTES sat on disk the whole time — the pile-up the operator
asked about. Nothing purged; there was no scheduler at all.

Retention is server-owned: `trash_retention_days` (default 30, 0 = keep
forever) in the settings registry, so it lands in admin Settings with no
migration and takes effect without a restart. A background sweep started in
before_serving does the work. Clients learn about a purge the way they learn
about any deletion — as a tombstone on the delta feed.

An auto-purge nobody can see coming is data loss on a timer, so the window is
now visible: /api/config publishes it, notes carry `deleted_at`, Trash leads
with the policy, and each card counts down. The countdown rounds DOWN — saying
"1 day left" for a note with ten minutes on the clock is the one error here
that actually costs someone a note.

Three things this turned up on the way:

- `DELETE /api/notes/<id>` hard-deleted the row, leaving no tombstone at all.
  A permanent delete in the web UI never reached a linked device, which would
  keep its copy forever and push it back on the next edit. It now purges
  through the same path as everything else.
- The purge left `note_revisions` and `note_link_previews` behind. A revision
  holds the full body, so the text of a "permanently deleted" note was still
  sitting in the database.
- `deleted_at` now SURVIVES a purge instead of being cleared. It's still true,
  and it means every query that says "not trashed" excludes tombstones for
  free — without it a content-less row reads as a perfectly normal active note
  and shows up on the board as a blank card.

Desktop keeps its own clock only when there's nobody else to keep one: the
sweep runs at startup on an UNLINKED device and refuses otherwise. A linked
client that expired notes on its own schedule could destroy something the
server was deliberately keeping, then push that delete upstream. Local policy
must never outrank the server's — so it also adopts the server's window for
the countdown rather than showing its offline default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

src/thoughtsync/notes/helpers.py

@@ -45,20 +45,33 @@ def parse_list_items(raw: object) -> list[str]:
 
 
 def apply_filter(stmt, filter_name: str):
-    """Narrow a notes query to one board view."""
+    """Narrow a notes query to one board view.
+
+    Every branch excludes purge tombstones — content-less rows kept only so the sync
+    feed can tell offline clients a note is gone (see `retention.purge_note`). The
+    active/archived branches get that for free from `deleted_at IS NULL`, since a
+    tombstone keeps the timestamp; Trash is the one view that has to say so.
+    """
     if filter_name == "archived":
         return stmt.where(Note.deleted_at.is_(None), Note.archived.is_(True))
     if filter_name == "trash":
-        return stmt.where(Note.deleted_at.is_not(None))
+        return stmt.where(Note.deleted_at.is_not(None), Note.purged_at.is_(None))
     return stmt.where(Note.deleted_at.is_(None), Note.archived.is_(False))
 
 
 async def _get_owned(db, note_id: str) -> Note | None:
-    """Fetch a note the current user OWNS (mutations are owner-only in M1/M2)."""
+    """Fetch a note the current user OWNS (mutations are owner-only in M1/M2).
+
+    A purged note reads as absent: the REST API must treat it as gone, so opening,
+    editing or restoring one 404s. The sync push path looks rows up directly rather
+    than through here, which is what still lets a client re-create an id it owns.
+    """
     nid = parse_uuid(note_id)
     if nid is None:
         return None
-    return await db.scalar(select(Note).where(Note.id == nid, Note.owner_id == g.user_id))
+    return await db.scalar(
+        select(Note).where(Note.id == nid, Note.owner_id == g.user_id, Note.purged_at.is_(None))
+    )
 
 
 def _escape_like(s: str) -> str: