Retention policy (auto-purge aged history) + at-rest encryption (follow-up to #272)

[CheeryProgrammer]

Follow-up to #272 (part of #208). The first slice added per-fact hard-delete (kb erase --node/--source, core.EraseNode/EraseSource, audited, wall-checked). Remaining from #272:

• Retention policy — an optional, configurable auto-purge of aged historical rows (superseded nodes/edges past a retention window) so the "keep everything" default doesn't grow unbounded. A consolidate-style sweep or a scheduled job; config retention.max_age / retention.enabled; DB-gated test. Must never touch current rows.
• At-rest encryption — either document reliance on encrypted volumes (the pragmatic default: LUKS / cloud-provider disk encryption, since Postgres data + pgvector live in the DB volume) in the security guide, or add app-level column encryption for the most sensitive fields (why, chunk text) behind a config flag. Start with the documented volume-encryption guidance; app-level encryption is a larger design.

Both unit/DB-testable (retention) or docs (encryption) — no live infra required for the retention sweep.