Evict archive writers on deletion and sweep idle archives (closes #89)

The per-webhook archiveWriter registry in the database delivery target
was never evicted, so a deleted webhook's writer -- and any archive
file handle open within its debounce window -- lingered for the process
lifetime. Separately, expiry pruning ran only when an archive was
(re)opened, and reopens only happen on writes, so an archive belonging
to a webhook that stopped receiving events kept its expired rows
forever.

Eviction: a new one-method delivery.WebhookEvictor interface (kept
separate from Notifier: archiving lifecycle is not notification) is
implemented by the Engine and injected into the handlers. Deleting a
webhook, or deleting its last database target, drops the writer from
the registry and closes its handle under the writer's own mutex, so
eviction can never race an in-flight write. An evicted writer refuses
further writes rather than reopening a file nothing holds. The archive
file is deliberately left on disk: it is long-term storage an operator
may want to keep or move away, and destroying it as a side effect of
deleting a webhook would be unrecoverable.

Idle sweep: a new ArchiveSweeper, modelled on the event RetentionReaper
(fx lifecycle hooks, cancellable context, WaitGroup, ticker loop),
prunes archives whose database target declares a positive expiry. It
reuses the existing RETENTION_SWEEP_INTERVAL rather than adding a
config key. It never creates an archive -- a missing file is skipped,
and the reopen uses SQLite mode=rw so the file cannot be conjured even
if it disappears mid-sweep -- routes the prune through the per-webhook
writer so its mutex orders the sweep against concurrent writes, and
leaves the archive closed so the move-the-file-away workflow keeps
working. A failure for one webhook is logged and the sweep continues.
Archives with no expiry or the expiry "never" are untouched.

internal/delivery/target_database.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"sync"
+	"time"
 
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -111,15 +112,11 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 func (t *databaseTarget) writerFor(
 	webhookID string,
 ) (*archiveWriter, error) {
-	if t.eng.dbManager == nil {
-		return nil, errArchiveNoDataDir
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return nil, err
 	}
 
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
-	path := filepath.Join(
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
-	)
-
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
@@ -135,3 +132,86 @@ func (t *databaseTarget) writerFor(
 
 	return w, nil
 }
+
+// archivePath returns the archive file path for a webhook: it
+// lives beside the per-webhook event database in the data
+// directory. It does not touch the filesystem.
+func (t *databaseTarget) archivePath(
+	webhookID string,
+) (string, error) {
+	if t.eng.dbManager == nil {
+		return "", errArchiveNoDataDir
+	}
+
+	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
+
+	return filepath.Join(
+		dir, fmt.Sprintf("archive-%s.db", webhookID),
+	), nil
+}
+
+// evict drops a webhook's archive writer from the registry and
+// closes its handle, so a deleted webhook does not leave a
+// writer (and an open archive handle within its debounce
+// window) alive for the process lifetime.
+//
+// The map entry is removed under the registry lock, which is
+// then released before the handle is closed under the writer's
+// own lock: that ordering keeps the registry available to other
+// webhooks while an in-flight write on this one drains, and
+// closing under the writer's lock means eviction can never race
+// a write.
+//
+// Eviction is idempotent and silent for a webhook with no
+// writer, which is the common case: a webhook with no database
+// target never creates one. It never deletes the archive file.
+func (t *databaseTarget) evict(webhookID string) {
+	t.mu.Lock()
+
+	w, ok := t.writers[webhookID]
+	if ok {
+		delete(t.writers, webhookID)
+	}
+
+	t.mu.Unlock()
+
+	if !ok {
+		return
+	}
+
+	w.evict()
+
+	t.eng.log.Info(
+		"evicted archive writer",
+		"webhook_id", webhookID,
+		"path", w.path,
+	)
+}
+
+// sweepWebhook prunes one webhook's archive of rows older than
+// expiry, without requiring a write. It returns nil (nothing to
+// do) when the archive file does not exist, so a sweep never
+// creates an archive for a webhook that has a database target
+// but has never received an event.
+func (t *databaseTarget) sweepWebhook(
+	webhookID string, expiry time.Duration,
+) error {
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return err
+	}
+
+	// Check before taking a writer at all: a webhook whose
+	// archive has never been created gets no writer, no handle,
+	// and no file.
+	if !fileExists(path) {
+		return nil
+	}
+
+	w, err := t.writerFor(webhookID)
+	if err != nil {
+		return err
+	}
+
+	return w.sweepExpired(expiry)
+}