Close the retention follow-ups from the August review (closes #99)

A retention value above the keep-forever sentinel is now pinned by a
test to be stored as the sentinel. parseRetentionDays returns the
form's message directly, so the two error values that only existed to
pick that message are gone. The sweep no longer checks keep-forever
itself; retentionCutoff does, before the webhook's database is opened.
The create-form refill test uses HTML-special characters and checks
they come back escaped.

Model: opus-5-5

internal/database/retention_test.go

@@ -362,7 +362,7 @@ func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
 		t,
 		overflowingRetentionDays,
 		database.RetentionForeverDays,
-		"the test value must not be rescued by the forever skip",
+		"the test value must not be treated as retain-forever",
 	)
 
 	webhookID := createWebhook(