feat: phase 6 production hardening + DB-to-DB transfer

Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
  retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
  auth middleware; scope picker + badges in Settings UI; scopeless legacy
  keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
  fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
  which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY

Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
  (migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
  to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
  against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)

Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
  target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
  verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
  (429s = configured rate limiter working)

Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/services/retention.go

@@ -0,0 +1,63 @@
+package services
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/tdvorak/primora/apps/backend/internal/repositories"
+)
+
+// RetentionSweeper deletes telemetry events, audit rows, and webhook
+// deliveries that are past each project's retention window. It runs once
+// shortly after boot and then hourly — a missed sweep is not a problem, the
+// next tick catches it.
+type RetentionSweeper struct {
+	repo     *repositories.CoreRepository
+	logger   *slog.Logger
+	interval time.Duration
+}
+
+func NewRetentionSweeper(repo *repositories.CoreRepository, logger *slog.Logger) *RetentionSweeper {
+	return &RetentionSweeper{repo: repo, logger: logger, interval: time.Hour}
+}
+
+func (s *RetentionSweeper) Run(ctx context.Context) {
+	// jarvis: initial delay — let migrations and first-party seeds settle before sweeping.
+	timer := time.NewTimer(time.Minute)
+	defer timer.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-timer.C:
+			s.Sweep(ctx)
+			timer.Reset(s.interval)
+		}
+	}
+}
+
+func (s *RetentionSweeper) Sweep(ctx context.Context) {
+	q := s.repo.Queries()
+	for _, sweep := range []struct {
+		name string
+		fn   func(context.Context) (int64, error)
+	}{
+		{"events", q.SweepExpiredEvents},
+		{"audit_logs", q.SweepExpiredAuditLogs},
+		{"audit_logs_org", q.SweepExpiredOrgAuditLogs},
+		{"webhook_deliveries", q.SweepExpiredWebhookDeliveries},
+	} {
+		rows, err := sweep.fn(ctx)
+		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			s.logger.Warn("retention sweep failed", "stream", sweep.name, "error", err)
+			continue
+		}
+		if rows > 0 {
+			s.logger.Info("retention sweep removed rows", "stream", sweep.name, "rows", rows)
+		}
+	}
+}