Rotate a database target's archive monthly, daily or hourly (closes #379)

A database target's rotation (none, monthly, daily or hourly) puts the
UTC period of each event's receive time in its archive file name, so
each file holds exactly its period's events. It is on the new webhook
page, the add target form and the target edit form, and shown in the
target list.

Renames move every one of a target's files and move them back if one
fails. The sweep prunes every file, one at a time under the target's
lock, and deletes a rotated file it leaves empty. Download lists the
files, then opens one at a time, oldest first, finding each again under
the target's current names, and gives each row its period. The target
list names the current file and totals the size of all of them.

Model: opus-5-5

internal/handlers/target_download_test.go

@@ -13,6 +13,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -85,7 +87,7 @@ func TestHandleTargetDownload(t *testing.T) {
 }
 
 // TestHandleTargetDownload_WaitsForRename proves a download reads the
-// target's names and opens its archive under the lock a rename holds:
+// target's names and lists its archive under the lock a rename holds:
 // started while an edit is renaming the archive, it waits, and is
 // named for the target's new name.
 func TestHandleTargetDownload_WaitsForRename(t *testing.T) {
@@ -148,18 +150,17 @@ func (s *stalledWriter) Write(b []byte) (int, error) {
 	return s.ResponseRecorder.Write(b)
 }
 
-// TestHandleTargetDownload_StreamsWithoutTheLock proves a download
-// lets go of the rename lock once its archive is open: while the
-// download is stalled writing, an edit can still rename the target.
-func TestHandleTargetDownload_StreamsWithoutTheLock(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhookWithRetention(t, env.db, 7)
-	archive := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+// startStalledDownload starts a download of the target and returns once
+// it is stalled at its first write, which comes before it opens any
+// archive file. Closing the writer's resume lets it go on; the returned
+// channel is closed when it has finished.
+func startStalledDownload(
+	t *testing.T, env *sourceTestEnv, webhookID, targetID string,
+) (*stalledWriter, <-chan struct{}) {
+	t.Helper()
 
 	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, downloadPath(wh.ID, archive.ID), nil,
+		t.Context(), http.MethodGet, downloadPath(webhookID, targetID), nil,
 	)
 	for _, c := range env.cookies {
 		req.AddCookie(c)
@@ -179,6 +180,21 @@ func TestHandleTargetDownload_StreamsWithoutTheLock(t *testing.T) {
 
 	<-sw.writing
 
+	return sw, downloaded
+}
+
+// TestHandleTargetDownload_StreamsWithoutTheLock proves a download
+// lets go of the rename lock once it has listed its archive: while the
+// download is stalled writing, an edit can still rename the target.
+func TestHandleTargetDownload_StreamsWithoutTheLock(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	archive := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+
+	sw, downloaded := startStalledDownload(t, env, wh.ID, archive.ID)
+
 	edited := make(chan *httptest.ResponseRecorder, 1)
 
 	go func() {
@@ -197,6 +213,62 @@ func TestHandleTargetDownload_StreamsWithoutTheLock(t *testing.T) {
 	assert.Equal(t, http.StatusOK, sw.Code)
 }
 
+// TestHandleTargetDownload_FindsFilesAfterRename proves a download
+// finds each of the target's files again under the names stored when
+// it reaches the file: the target is renamed while the download is
+// stalled before it has opened any file, and the rows of both its files
+// are in the download.
+func TestHandleTargetDownload_FindsFilesAfterRename(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	wh := seedWebhookWithRetention(t, env.db, 7)
+	archive := seedTarget(t, env.db, wh.ID, database.TargetTypeDatabase)
+	oldPath := delivery.ArchivePath(env.dbMgr, &wh, archive)
+
+	month := func(path string) string {
+		return strings.TrimSuffix(path, ".db") + "-2026-10.db"
+	}
+
+	seedArchive(t, oldPath, 1, 16)
+	seedArchive(t, month(oldPath), 1, 16)
+
+	sw, downloaded := startStalledDownload(t, env, wh.ID, archive.ID)
+
+	require.Equal(t,
+		http.StatusSeeOther, renameTarget(env, wh.ID, archive.ID).Code,
+	)
+
+	// The test's archives record a rename without moving any file, so
+	// the files are moved here, as the delivery engine moves them.
+	var renamed database.Target
+
+	require.NoError(t, env.db.DB().First(&renamed, "id = ?", archive.ID).Error)
+
+	newPath := delivery.ArchivePath(env.dbMgr, &wh, &renamed)
+
+	require.NoError(t, os.Rename(oldPath, newPath))
+	require.NoError(t, os.Rename(month(oldPath), month(newPath)))
+
+	close(sw.resume)
+	<-downloaded
+	require.Equal(t, http.StatusOK, sw.Code)
+
+	zr, err := gzip.NewReader(sw.Body)
+	require.NoError(t, err)
+
+	var (
+		got    map[string]json.RawMessage
+		events []map[string]any
+	)
+
+	require.NoError(t, json.NewDecoder(zr).Decode(&got))
+	require.NoError(t, json.Unmarshal(got["archived_events"], &events))
+	require.Len(t, events, 2)
+	assert.NotContains(t, events[0], "period")
+	assert.Equal(t, "2026-10", events[1]["period"])
+}
+
 // seedArchive writes rows to the archive file at path, each with a
 // body of bodySize random bytes, which do not compress. Its table has
 // only the columns the test fills; an export writes the others empty.