fix(audit): retention TTL on runtime-written audit rows (v0.1.25.15)

[amavashev]

Summary

Closes the retention-TTL gap surfaced by the post-v0.1.25.14 alignment audit against cycles-server-admin. Runtime's AuditRepository.log() previously wrote audit:log:{id} keys with no EXPIRE, so runtime-written rows persisted indefinitely until Redis memory-eviction — silently failing to participate in the 400-day retention tier admin applies to authenticated audit rows.

• LOG_AUDIT_LUA now reads ARGV[4] as an optional TTL in seconds (same shape as admin's Lua, minus sentinel branching).
• New audit.retention.days config (default 400, env AUDIT_RETENTION_DAYS). 0 = indefinite retention for legal-hold / archive-store deployments.
• New audit.sweep.cron config (default 0 0 3 * * *, env AUDIT_SWEEP_CRON). Daily @Scheduled sweep prunes stale ZSET pointers on audit:logs:_all + per-tenant indexes. Mirrors admin's sweepStaleIndexEntries() so runtime is self-healing regardless of whether admin is colocated.

Runtime only writes real-tenant audit rows (never the admin-plane __admin__ / __unauth__ sentinels), so a single-tier TTL is sufficient — unlike admin's two-tier setup.

No wire change. No API change. Admin's reader is already null-body-tolerant for TTL-expired pointers.

Test plan

• New AuditRepositoryTest — 7 cases (TTL passed as ARGV[4] = 400×86400, retention=0 passes "0", logId + timestamp set, log() failure non-fatal, sweeper removes global + per-tenant pointers, sweeper no-op when retention=0, sweep failure non-fatal).
• Full data module: 365 / 365 green.
• Full api module: 152 / 152 green.
• Manual Redis smoke: write an audit row via the admin-on-behalf-of release path, redis-cli TTL audit:log:<id> returns a positive integer near 34560000 (400 × 86400).
• Parallel-sweep check: run alongside admin's sweep against the same Redis — no errors, no double-deleted pointers.