Phase 7 follow-up: 1-month body retention and actions_log cap (AUD-75)

Implements the AGENTS.md §7 data rule: keep message bodies for one month, and
size-cap the append-only action log.

- internal/store/retention.go: Store.Retain clears messages.body_text older
  than the window (metadata stays) and deletes actions_log rows beyond the
  newest N, in one transaction.
- internal/config: EMAIL_AGENT_RETENTION_DAYS (30) and
  EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS (50000).
- cmd/email-agent: bounded -retain flag for the n8n schedule.
- Tests for body clearing, metadata retention, log cap, and disabled policy.

internal/config/config.go

@@ -60,6 +60,11 @@ const (
 	// fans out to email/NTFY/Telegram. SUMMARY_TO is the summary recipient.
 	DefaultAppriseURL = "http://192.168.20.35:8210"
 	DefaultSummaryTo  = "samuelrolfe@gmail.com"
+
+	// Retention defaults (AGENTS.md §7): keep message bodies for one month, and
+	// cap the append-only action log. The retention job is the CLI `-retain`.
+	DefaultRetentionDays     = 30
+	DefaultActionsLogMaxRows = 50000
 )
 
 // Config is the fully resolved runtime configuration.
@@ -153,6 +158,14 @@ type Config struct {
 	AppriseToken string
 	// SummaryTo is the recipient address for the daily summary email.
 	SummaryTo string
+
+	// RetentionDays is the message-body window in days (AGENTS.md §7: one
+	// month). Bodies of messages received more than this many days ago are
+	// cleared by the `-retain` job; metadata is kept.
+	RetentionDays int
+	// ActionsLogMaxRows caps the append-only actions_log. The oldest rows beyond
+	// this count are deleted by the `-retain` job.
+	ActionsLogMaxRows int
 }
 
 // Load reads configuration from the environment, applying defaults.
@@ -197,6 +210,8 @@ func Load() (*Config, error) {
 	c.IMAPMaxMessages = getenvDefaultInt("EMAIL_AGENT_IMAP_MAX_MESSAGES", DefaultIMAPMaxMessages)
 	c.ClassifyConcurrency = getenvDefaultInt("EMAIL_AGENT_CLASSIFY_CONCURRENCY", DefaultClassifyConcurrency)
 	c.ClassifyMaxMessages = getenvDefaultInt("EMAIL_AGENT_CLASSIFY_MAX_MESSAGES", DefaultClassifyMaxMessages)
+	c.RetentionDays = getenvDefaultInt("EMAIL_AGENT_RETENTION_DAYS", DefaultRetentionDays)
+	c.ActionsLogMaxRows = getenvDefaultInt("EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS", DefaultActionsLogMaxRows)
 
 	port, err := resolvePort()
 	if err != nil {

internal/config/config_test.go

@@ -9,6 +9,7 @@ func TestLoadDefaults(t *testing.T) {
 		"EMAIL_AGENT_DB_PATH", "EMAIL_AGENT_LOG_LEVEL", "EMAIL_AGENT_PUBLIC_BASE_URL",
 		"GMAIL_USER", "GMAIL_APP_PASSWORD", "EMAIL_AGENT_IMAP_HOST", "EMAIL_AGENT_IMAP_PORT",
 		"EMAIL_AGENT_IMAP_LOOKBACK_DAYS", "EMAIL_AGENT_IMAP_MAX_MESSAGES",
+		"EMAIL_AGENT_RETENTION_DAYS", "EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS",
 	} {
 		t.Setenv(k, "")
 	}
@@ -46,6 +47,35 @@ func TestLoadDefaults(t *testing.T) {
 	}
 }
 
+func TestRetentionDefaultsAndOverrides(t *testing.T) {
+	t.Setenv("EMAIL_AGENT_RETENTION_DAYS", "")
+	t.Setenv("EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS", "")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.RetentionDays != DefaultRetentionDays {
+		t.Errorf("RetentionDays = %d, want %d", cfg.RetentionDays, DefaultRetentionDays)
+	}
+	if cfg.ActionsLogMaxRows != DefaultActionsLogMaxRows {
+		t.Errorf("ActionsLogMaxRows = %d, want %d", cfg.ActionsLogMaxRows, DefaultActionsLogMaxRows)
+	}
+
+	t.Setenv("EMAIL_AGENT_RETENTION_DAYS", "45")
+	t.Setenv("EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS", "1234")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("Load() override error = %v", err)
+	}
+	if cfg.RetentionDays != 45 {
+		t.Errorf("RetentionDays = %d, want 45", cfg.RetentionDays)
+	}
+	if cfg.ActionsLogMaxRows != 1234 {
+		t.Errorf("ActionsLogMaxRows = %d, want 1234", cfg.ActionsLogMaxRows)
+	}
+}
+
 func TestGmailConfigured(t *testing.T) {
 	t.Setenv("GMAIL_USER", "samuelrolfe@gmail.com")
 	t.Setenv("GMAIL_APP_PASSWORD", "app-password")