Fail deliveries on archive errors; validate expiry at creation (#43)

Two review findings on the database archiving target:

- An archive error now records the attempt as failed with the
  error string and marks the delivery failed, instead of logging
  the error and reporting success. A target that could not do its
  one job must not claim it did.
- The archive expiry is now actually configurable: the add-target
  form gains an expiry field for database targets, and the value
  is validated at creation time via the new
  delivery.ValidateArchiveExpiry (empty, "never", or a positive
  Go duration), rejecting bad values with a 400 at the only place
  a human can fix them, mirroring how Slack target URLs are
  validated at creation.

Test updates: a forced archive failure asserts a failed delivery
with a recorded error and no archive file; config builder tests
cover empty/never/duration and rejection paths; the two engine
tests that exercise the database target now build engines with a
real webhook DB manager since archiving is no longer a no-op; the
reopen-debounce test uses a wider window so parallel test load
cannot make two rapid writes straddle it.

internal/handlers/handlers_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -186,3 +188,84 @@ func TestRenderTemplate(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 	)
 }
+
+// databaseConfigRequest builds a POST request carrying the
+// given expiry as a form value, as the add-target form does.
+func databaseConfigRequest(expiry string) *http.Request {
+	form := url.Values{}
+	if expiry != "" {
+		form.Set("expiry", expiry)
+	}
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, "/",
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	return req
+}
+
+func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	// Empty expiry: the keep-forever default, empty config.
+	w := httptest.NewRecorder()
+	cfg, err := h.BuildDatabaseTargetConfigForTest(
+		w, databaseConfigRequest(""),
+	)
+	require.NoError(t, err)
+	assert.Empty(t, cfg)
+
+	// Explicit never is stored as config.
+	w = httptest.NewRecorder()
+	cfg, err = h.BuildDatabaseTargetConfigForTest(
+		w, databaseConfigRequest("never"),
+	)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
+
+	// A positive duration is stored as config.
+	w = httptest.NewRecorder()
+	cfg, err = h.BuildDatabaseTargetConfigForTest(
+		w, databaseConfigRequest("720h"),
+	)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
+}
+
+func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	for _, bad := range []string{"nonsense", "7d", "-5h"} {
+		w := httptest.NewRecorder()
+		cfg, err := h.BuildDatabaseTargetConfigForTest(
+			w, databaseConfigRequest(bad),
+		)
+
+		require.Error(t, err, "expiry %q", bad)
+		assert.Empty(t, cfg)
+		assert.Equal(
+			t, http.StatusBadRequest, w.Code,
+			"expiry %q should be rejected with 400", bad,
+		)
+	}
+}