store: expired rows are swept, and the audit log stops copying prose !233

Stacked on !232.

Store.Sweep removes expired sessions and tokens regardless of configuration, then rows past each [retention] duration. Unset means keep forever — every existing instance is unchanged. gitbayd sweeps hourly and once at start.

One hazard worth naming: webhook_deliveries.event_id is ON DELETE CASCADE, so a naive events sweep takes deliveries still queued for retry with it. Finished deliveries go first and any event with an unfinished one is skipped, which makes a delivery's real retention the shorter of the two. Tested.

The audit entry now records flag names without their values. Secrets never reached argv — they travel on stdin — but prose did: --body <the whole issue> was stored verbatim, in a table nothing pruned, for a repository that may be private. Identifiers are positional and survive.

Closes #122