P2-3d - Zero-retention ingestion/delivery path + graceful inbox, export, replay

[jterry136]

Chunk: P2-3 — Configurable retention · Requirements: FR-SUB-3, NFR-PRIV-1 · Depends on: the retention schema + purge worker issues · Constrained by: P-5, P-3

Implement zero-retention end to end: store nothing beyond what delivery needs.

Scope

In

• Ingestion (src/lib/ingest.ts). Keep P-5 intact — the submission is still persisted before any delivery is attempted; zero-retention changes how long it lives, not whether it is written. Follow the Q-3 decision on whether rawBody is skipped for zero-retention forms.
• Post-delivery purge. As soon as every destination for a submission reaches a terminal state (succeeded / dead_letter), delete the submission per the decision. Hook this into the delivery path in src/lib/queue.ts or the retention pass — whichever keeps the ingestion path fast and side-effect-light (P-3).
• Surfaces degrade gracefully. The inbox (src/lib/inbox.ts, src/routes/dashboard/forms.$formId.tsx), export, and replay (src/lib/replay.ts) must show an explicit "not retained" state for a zero-retention form rather than an empty list that reads like a bug or a crash on a missing row.
• Integration tests: a zero-retention form still delivers successfully; the submission is gone after terminal delivery; a dead-lettered delivery behaves as decided; the inbox/export/replay surfaces behave sanely.

Out

• Retention UI and the generic age-based purge (separate issues).

Acceptance criteria

• Delivery to all destination types still works with zero-retention enabled (P-5 unbroken — persist, then delete).
• No submission payload survives past terminal delivery on a zero-retention form.
• Inbox, export, and replay show a clear "not retained" state instead of failing.
• npm run typecheck, npm run lint, npm test all green.