Evict archive writers on deletion and sweep idle archives (closes #89)

The per-webhook archiveWriter registry in the database delivery target
was never evicted, so a deleted webhook's writer -- and any archive
file handle open within its debounce window -- lingered for the process
lifetime. Separately, expiry pruning ran only when an archive was
(re)opened, and reopens only happen on writes, so an archive belonging
to a webhook that stopped receiving events kept its expired rows
forever.

Eviction: a new one-method delivery.WebhookEvictor interface (kept
separate from Notifier: archiving lifecycle is not notification) is
implemented by the Engine and injected into the handlers. Deleting a
webhook, or deleting its last database target, drops the writer from
the registry and closes its handle under the writer's own mutex, so
eviction can never race an in-flight write. An evicted writer refuses
further writes rather than reopening a file nothing holds. The archive
file is deliberately left on disk: it is long-term storage an operator
may want to keep or move away, and destroying it as a side effect of
deleting a webhook would be unrecoverable.

Idle sweep: a new ArchiveSweeper, modelled on the event RetentionReaper
(fx lifecycle hooks, cancellable context, WaitGroup, ticker loop),
prunes archives whose database target declares a positive expiry. It
reuses the existing RETENTION_SWEEP_INTERVAL rather than adding a
config key. It never creates an archive -- a missing file is skipped,
and the reopen uses SQLite mode=rw so the file cannot be conjured even
if it disappears mid-sweep -- routes the prune through the per-webhook
writer so its mutex orders the sweep against concurrent writes, and
leaves the archive closed so the move-the-file-away workflow keeps
working. A failure for one webhook is logged and the sweep continues.
Archives with no expiry or the expiry "never" are untouched.

The sweep loop's context is rooted at context.Background(), not at the
fx OnStart hook context. The hook context carries fx's 15 second start
timeout, so a loop derived from it is cancelled three quarters of an
hour before the first tick under the default one-hour interval, giving
a sweeper that never sweeps. OnStop still cancels the loop and waits on
the WaitGroup, so shutdown is unchanged.

The sweep also never leaves a registry entry behind. Reaching the
writer through the ordinary create-and-cache accessor would let a sweep
that raced a webhook deletion re-insert a writer for a webhook that no
longer exists, which nothing would ever evict again -- the very leak
this change closes. An entry the sweep has to create is marked
sweep-owned and released when the prune finishes, unless a delivery
claimed it meanwhile, in which case it belongs to the registry and an
eviction can still reach it. A writer evicted underneath a sweep is an
ordinary interleaving and is logged at debug, not error.

Each of those guards is pinned by a test that fails when the guard is
removed. The adopt-during-sweep window -- a delivery claiming the
sweep's own registry entry while that sweep is still running -- is
driven directly against the registry, because a delivery placed between
two sweeps never reaches the release path at all. The requirement that
an idle archive ends the sweep closed is asserted both on a writer
proven to hold an open handle beforehand and, end to end, on a
delivery-owned entry the sweep keeps, rather than on an entry the sweep
has already released and which therefore reports "not open" either
way. The "never" expiry short circuit is checked against an archive
file that has never been migrated, so any open of it would be
observable as a created table.

internal/delivery/engine.go

@@ -94,6 +94,23 @@ type Notifier interface {
 	Notify(tasks []Task)
 }
 
+// WebhookEvictor releases the delivery engine's per-webhook
+// state for a webhook that no longer needs it — currently the
+// cached archive writer of the database target, whose open
+// file handle would otherwise outlive the webhook.
+//
+// It is deliberately separate from Notifier and deliberately
+// one method wide: archiving lifecycle is not notification, and
+// a single-method interface keeps the handlers package free of
+// any dependency on the engine's internals while staying
+// trivially fakeable in tests.
+//
+// EvictWebhook never deletes an archive file. It is idempotent
+// and is a no-op for a webhook with no engine state.
+type WebhookEvictor interface {
+	EvictWebhook(webhookID string)
+}
+
 // EngineParams are the fx dependencies for the delivery
 // engine.
 type EngineParams struct {
@@ -127,6 +144,10 @@ type Engine struct {
 	// httpTarget is retained so tests can reach the HTTP
 	// target's shared client and circuit breakers.
 	httpTarget *httpTarget
+
+	// dbTarget is retained so the engine can reach the archive
+	// writer registry for webhook eviction and the idle sweep.
+	dbTarget *databaseTarget
 }
 
 // New creates and registers the delivery engine with the
@@ -182,6 +203,19 @@ func (e *Engine) Notify(tasks []Task) {
 	}
 }
 
+// EvictWebhook implements WebhookEvictor. It releases the
+// engine's per-webhook archiving state: the database target's
+// cached archive writer is dropped from the registry and its
+// file handle closed. The archive file itself is left on disk
+// — it is long-term storage the operator owns.
+func (e *Engine) EvictWebhook(webhookID string) {
+	if e.dbTarget == nil {
+		return
+	}
+
+	e.dbTarget.evict(webhookID)
+}
+
 // ScheduleRetry schedules a task to be re-enqueued onto the
 // retry channel after delay. It implements the Scheduler
 // interface the targets use to own their durable retries.