Name each database target's archive for its webhook and target (closes #376)

Each database target now has its own archive file,
archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, instead of one
archive-WEBHOOKID.db per webhook. delivery.ArchiveFileName builds the
name: each name is lowercased, keeps ASCII letters and digits, turns
every other run of characters into one dash, and is cut to 40
characters.

A change of webhook or target name renames its archive files under the
archive writer's lock, before the new name is saved, and back again if
the save fails. A rename never replaces a file, and one that fails part
way moves back what it moved. Deleting a target evicts only that
target's writer. Archive files are never deleted, and nothing looks for
files under the old name.

Model: opus-5-5

internal/delivery/engine.go

@@ -123,21 +123,24 @@ type Notifier interface {
 	Notify(tasks []Task)
 }
 
-// WebhookEvictor releases the delivery engine's per-webhook
-// state for a webhook that no longer needs it — currently the
-// cached archive writer of the database target, whose open
-// file handle would otherwise outlive the webhook.
+// Archives is how the handlers keep the database targets' archive
+// files in step with the configuration. Deleting a webhook or a
+// target releases the cached archive writers, whose open file
+// handles would otherwise outlive them; renaming one renames the
+// archive files, which are named for the webhook and the target
+// (see ArchiveFileName).
 //
-// It is deliberately separate from Notifier and deliberately
-// one method wide: archiving lifecycle is not notification, and
-// a single-method interface keeps the handlers package free of
-// any dependency on the engine's internals while staying
-// trivially fakeable in tests.
+// It is deliberately separate from Notifier: archiving lifecycle
+// is not notification, and a small interface keeps the handlers
+// package free of any dependency on the engine's internals while
+// staying trivially fakeable in tests.
 //
-// EvictWebhook never deletes an archive file. It is idempotent
-// and is a no-op for a webhook with no engine state.
-type WebhookEvictor interface {
+// Neither eviction deletes an archive file. Both are idempotent
+// and are no-ops for a webhook or target with no engine state.
+type Archives interface {
 	EvictWebhook(webhookID string)
+	EvictTarget(targetID string)
+	Rename(targetID, webhookName, targetName string) error
 }
 
 // EngineParams are the fx dependencies for the delivery
@@ -188,7 +191,7 @@ type Engine struct {
 	httpTarget *httpTarget
 
 	// dbTarget is retained so the engine can reach the archive
-	// writer registry for webhook eviction and the idle sweep.
+	// writer registry for eviction, renames and the idle sweep.
 	dbTarget *databaseTarget
 
 	// inflight is the set of deliveries this engine currently owns.
@@ -257,17 +260,44 @@ func (e *Engine) Notify(tasks []Task) {
 	}
 }
 
-// EvictWebhook implements WebhookEvictor. It releases the
-// engine's per-webhook archiving state: the database target's
-// cached archive writer is dropped from the registry and its
-// file handle closed. The archive file itself is left on disk
-// — it is long-term storage the operator owns.
+// EvictWebhook implements Archives. The cached archive writer of
+// every database target of the webhook is dropped from the
+// registry and its file handle closed. The archive files
+// themselves are left on disk — they are long-term storage the
+// operator owns.
 func (e *Engine) EvictWebhook(webhookID string) {
 	if e.dbTarget == nil {
 		return
 	}
 
-	e.dbTarget.evict(webhookID)
+	e.dbTarget.evictWebhook(webhookID)
+}
+
+// EvictTarget implements Archives. It is EvictWebhook for a single
+// database target, and leaves the archive file on disk the same
+// way.
+func (e *Engine) EvictTarget(targetID string) {
+	if e.dbTarget == nil {
+		return
+	}
+
+	e.dbTarget.evict(targetID)
+}
+
+// Rename implements Archives. It renames a database target's
+// archive file to ArchiveFileName(webhookName, targetName,
+// targetID), under the lock the target's archive writes and the
+// idle sweep take. It never replaces a file: if one already has the
+// new name, the error is ErrArchiveNameTaken. The caller renames
+// before it saves the new name: see databaseTarget.rename.
+func (e *Engine) Rename(
+	targetID, webhookName, targetName string,
+) error {
+	if e.dbTarget == nil {
+		return nil
+	}
+
+	return e.dbTarget.rename(targetID, webhookName, targetName)
 }
 
 // ScheduleRetry schedules a task to be re-enqueued onto the
@@ -381,7 +411,8 @@ func (e *Engine) start() {
 // Once the pool has drained it closes the archive writers, so a
 // clean stop leaves no archive -wal behind. Nothing else holds a
 // writer for long by then: the archive sweeper stops before the
-// engine, and deleting a webhook only closes one. If the pool did
+// engine, and deleting or renaming a webhook or target only closes
+// or moves one. If the pool did
 // not drain in time, the writers are left open, as a kill would
 // leave them. Closing them would wait for any write in progress,
 // and a worker still running would then open new writers that