Evict archive writers on deletion and sweep idle archives (closes #89)

The per-webhook archiveWriter registry in the database delivery target
was never evicted, so a deleted webhook's writer -- and any archive
file handle open within its debounce window -- lingered for the process
lifetime. Separately, expiry pruning ran only when an archive was
(re)opened, and reopens only happen on writes, so an archive belonging
to a webhook that stopped receiving events kept its expired rows
forever.

Eviction: a new one-method delivery.WebhookEvictor interface (kept
separate from Notifier: archiving lifecycle is not notification) is
implemented by the Engine and injected into the handlers. Deleting a
webhook, or deleting its last database target, drops the writer from
the registry and closes its handle under the writer's own mutex, so
eviction can never race an in-flight write. An evicted writer refuses
further writes rather than reopening a file nothing holds. The archive
file is deliberately left on disk: it is long-term storage an operator
may want to keep or move away, and destroying it as a side effect of
deleting a webhook would be unrecoverable.

Idle sweep: a new ArchiveSweeper, modelled on the event RetentionReaper
(fx lifecycle hooks, cancellable context, WaitGroup, ticker loop),
prunes archives whose database target declares a positive expiry. It
reuses the existing RETENTION_SWEEP_INTERVAL rather than adding a
config key. It never creates an archive -- a missing file is skipped,
and the reopen uses SQLite mode=rw so the file cannot be conjured even
if it disappears mid-sweep -- routes the prune through the per-webhook
writer so its mutex orders the sweep against concurrent writes, and
leaves the archive closed so the move-the-file-away workflow keeps
working. A failure for one webhook is logged and the sweep continues.
Archives with no expiry or the expiry "never" are untouched.

The sweep loop's context is rooted at context.Background(), not at the
fx OnStart hook context. The hook context carries fx's 15 second start
timeout, so a loop derived from it is cancelled three quarters of an
hour before the first tick under the default one-hour interval, giving
a sweeper that never sweeps. OnStop still cancels the loop and waits on
the WaitGroup, so shutdown is unchanged.

The sweep also never leaves a registry entry behind. Reaching the
writer through the ordinary create-and-cache accessor would let a sweep
that raced a webhook deletion re-insert a writer for a webhook that no
longer exists, which nothing would ever evict again -- the very leak
this change closes. An entry the sweep has to create is marked
sweep-owned and released when the prune finishes, unless a delivery
claimed it meanwhile, in which case it belongs to the registry and an
eviction can still reach it. A writer evicted underneath a sweep is an
ordinary interleaving and is logged at debug, not error.

internal/handlers/source_management.go

@@ -533,6 +533,13 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}
 
+	// Release the delivery engine's per-webhook archiving state
+	// so a deleted webhook's archive writer (and any handle open
+	// within its debounce window) does not linger for the
+	// process lifetime. The archive file itself is deliberately
+	// left on disk; see evictArchiveWriter.
+	h.evictArchiveWriter(webhook.ID)
+
 	err = h.dbMgr.DeleteDB(webhook.ID)
 	if err != nil {
 		h.log.Error(
@@ -551,6 +558,64 @@ func (h *Handlers) deleteWebhookResources(
 	http.Redirect(w, r, "/sources", http.StatusSeeOther)
 }
 
+// evictArchiveWriter asks the delivery engine to drop its
+// cached archive writer for a webhook, closing the archive file
+// handle.
+//
+// The archive database file is NOT deleted. Unlike the event
+// database — which is per-webhook working storage and is
+// hard-deleted with the webhook — an archive is explicitly
+// long-term storage that an operator may want to keep or move
+// away for offline retention. Destroying it as a side effect of
+// deleting a webhook would be a surprising and unrecoverable
+// data loss, so the file is left for the operator to handle.
+func (h *Handlers) evictArchiveWriter(webhookID string) {
+	if h.evictor == nil {
+		return
+	}
+
+	h.evictor.EvictWebhook(webhookID)
+}
+
+// evictArchiveWriterIfUnused releases a webhook's archive
+// writer once the webhook has no database target left to feed
+// it.
+//
+// It is called after any child resource of a webhook is
+// deleted, and is correct without knowing which kind was: it
+// evicts only when no database target remains, so deleting one
+// of several database targets — or deleting an unrelated
+// target type — leaves a still-needed writer alone. When no
+// database target ever existed there is no writer and eviction
+// is a no-op. Soft-deleted targets are excluded by GORM's
+// default scope, so the row just deleted is not counted.
+func (h *Handlers) evictArchiveWriterIfUnused(webhookID string) {
+	var remaining int64
+
+	err := h.db.DB().
+		Model(&database.Target{}).
+		Where(
+			"webhook_id = ? AND type = ?",
+			webhookID, database.TargetTypeDatabase,
+		).
+		Count(&remaining).Error
+	if err != nil {
+		h.log.Error(
+			"failed to count remaining database targets",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if remaining > 0 {
+		return
+	}
+
+	h.evictArchiveWriter(webhookID)
+}
+
 // HandleSourceLogs shows the request/response logs for a
 // webhook.
 func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
@@ -1024,23 +1089,31 @@ func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"entrypointID", &database.Entrypoint{},
 		"failed to delete entrypoint",
+		nil,
 	)
 }
 
-// HandleTargetDelete handles deleting a target.
+// HandleTargetDelete handles deleting a target. Deleting the
+// last database target of a webhook leaves its archive writer
+// with nothing to write, so the writer is evicted and its
+// handle closed; the archive file is left on disk.
 func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"targetID", &database.Target{},
 		"failed to delete target",
+		h.evictArchiveWriterIfUnused,
 	)
 }
 
 // deleteChildResource returns a handler that deletes a child
-// resource (entrypoint or target) belonging to a webhook.
+// resource (entrypoint or target) belonging to a webhook. The
+// optional afterDelete hook runs with the webhook's id once the
+// delete has succeeded, before the redirect.
 func (h *Handlers) deleteChildResource(
 	idParam string,
 	model any,
 	errMsg string,
+	afterDelete func(webhookID string),
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1080,6 +1153,10 @@ func (h *Handlers) deleteChildResource(
 			return
 		}
 
+		if afterDelete != nil {
+			afterDelete(webhook.ID)
+		}
+
 		http.Redirect(
 			w, r,
 			"/source/"+webhook.ID,