feat(api-rs): retention for session_events

[0xAlcibiades]

Closes #1508

Takes the in-process sweep rather than pg_cron. Migration 0007's pg_cron
precedent is real, but retention that depends on an extension only the bundled
paradedb image ships would not work for deployments running their own Postgres,
and this is exactly the knob such a deployment needs.

Change

SESSION_EVENTS_RETENTION_DAYS (chart: apiRs.sessionEventsRetentionDays,
default 0 = off) deletes session_events past the window on the existing
cleanup sweep, so it inherits sandboxCleanupIntervalSecs rather than adding a
second schedule.

Off by default. session_events is durable history; starting to delete it
on an existing deployment because a version was bumped would be the wrong
default even though the growth is real.

Three properties worth reviewing

Events of a queued or running execution are never deleted, whatever their
age. A long-running turn's early output is still needed to replay it, and age
alone does not separate "old" from "still in use". The left join also keeps
events whose execution row is gone (status is null), so an orphaned event is
retained rather than swept by accident.

Deletes are batched, and a sweep is bounded at 100k rows (5k × 20). The
first sweep after enabling retention can face millions of rows; one unbounded
delete would hold locks and bloat the table for its duration, and a sweep that
ran until done would hold the cleanup worker and its share of the connection
pool for as long. Successive sweeps drain the backlog.

Migration 0054 adds an index on created_at. The table had only
(thread_key, event_id) and (execution_id, event_type), so an age-keyed
delete would seq-scan the largest table in the schema on every pass — the
opposite of what a background sweep should do.

Note 0054 assumes 0053 is taken. If #1531 does not land first this should be
renumbered down.

Testing

Two unit tests: retention off by default without disabling the worker (the
sandbox arms still need it), and the per-sweep bound. The delete itself is
database-backed and unexercised here — I had no Postgres available, so the SQL
rests on review and CI rather than a local run. Flagging that rather than
implying otherwise.

cargo fmt --all --check and cargo clippy --all-targets -- -D warnings clean
across the three touched crates; cargo test passes. helm lint passes and
helm template renders the value.