Allow retention_days of 0 to mean retain forever (closes #79)

Rewrites retention_days=0 to the RetentionForeverDays sentinel (365 * 1000)
in Webhook.BeforeSave, so the GORM column default cannot win the race. The
reaper skips retain-forever webhooks before building any query.

Also bounds the reaper's cutoff arithmetic: a time.Duration is int64
nanoseconds, so day counts above MaxFiniteRetentionDays (106751) overflowed
and wrapped the cutoff into the future, where created_at < cutoff matched
every row and the sweep deleted everything. parseRetentionDays now rejects
finite values above the ceiling, and retentionCutoff saturates so rows
written by older versions cannot reach it either.

Views render RetentionLabel() rather than the raw sentinel.

README.md

@@ -345,13 +345,29 @@ event routing.
 | `user_id`        | UUID    | Foreign key → User |
 | `name`           | string  | Human-readable name |
 | `description`    | string  | Optional description |
-| `retention_days` | integer | Days to retain events (default: 30) |
+| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |
 
 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.
 
 The `retention_days` field controls how long event data is kept in the
 webhook's dedicated database before automatic cleanup.
 
+Setting `retention_days` to `0` means "retain events forever". Because
+the column carries a default of 30, a literal zero cannot survive an
+insert, so a zero is rewritten on save to a sentinel of `365 * 1000`
+days (`database.RetentionForeverDays`). The retention reaper recognises
+that sentinel and skips the webhook entirely, and the web UI displays
+such a webhook's retention as "forever" rather than as a day count.
+
+A *finite* retention is capped at `database.MaxFiniteRetentionDays`
+(106751 days, about 292 years), and a larger one is rejected with a
+400. The cap is not arbitrary: the reaper computes its cutoff as a
+`time.Duration`, an int64 nanosecond count, and a longer period
+overflows it. An overflowed cutoff lands in the future, where it
+matches every row, so the sweep would delete every event the webhook
+has instead of none. The reaper also clamps the value it is given, so a
+row written by an older version cannot trigger that either.
+
 #### Entrypoint
 
 A receiver URL where external services POST webhook events. Each
@@ -547,7 +563,7 @@ This separation provides:
   DB; the event database file is hard-deleted (permanently removed).
 - **Per-webhook retention** — the `retention_days` field on each webhook
   controls automatic cleanup of old events in that webhook's database
-  only.
+  only, or disables cleanup entirely when set to `0` (retain forever).
 - **Performance** — each webhook's database has its own WAL, its own
   page cache, and its own lock, so concurrent event ingestion across
   webhooks won't contend.