feat: use postgres

mail/docs/runtime.md

@@ -104,17 +104,21 @@ configuration or unavailable Redis.
 - processes only already claimed work items
 - concurrency is controlled by `MAIL_ATTEMPT_WORKER_CONCURRENCY`
 
-### Cleanup worker
+### SQL retention worker
 
-- removes stale delivery-index members after primary delivery expiry
-- does not clean `mail:attempt_schedule`
-- does not clean malformed-command index entries
+- periodically deletes expired `deliveries` rows whose retention window has
+  elapsed; cascades to `attempts`, `dead_letters`, `delivery_payloads`, and
+  `delivery_recipients`
+- periodically deletes expired `malformed_commands` rows
+- runs an immediate first pass at startup, then on `MAIL_CLEANUP_INTERVAL`
 
 ## Configuration Groups
 
 Required for all starts:
 
-- `MAIL_REDIS_ADDR`
+- `MAIL_REDIS_MASTER_ADDR`
+- `MAIL_REDIS_PASSWORD`
+- `MAIL_POSTGRES_PRIMARY_DSN`
 
 Core process config:
 
@@ -128,16 +132,23 @@ Internal HTTP config:
 - `MAIL_INTERNAL_HTTP_READ_TIMEOUT`
 - `MAIL_INTERNAL_HTTP_IDLE_TIMEOUT`
 
-Redis connectivity:
+Redis connectivity (`pkg/redisconn` shape):
 
-- `MAIL_REDIS_USERNAME`
+- `MAIL_REDIS_MASTER_ADDR`
+- `MAIL_REDIS_REPLICA_ADDRS`
 - `MAIL_REDIS_PASSWORD`
 - `MAIL_REDIS_DB`
-- `MAIL_REDIS_TLS_ENABLED`
 - `MAIL_REDIS_OPERATION_TIMEOUT`
 - `MAIL_REDIS_COMMAND_STREAM`
-- `MAIL_REDIS_ATTEMPT_SCHEDULE_KEY`
-- `MAIL_REDIS_DEAD_LETTER_PREFIX`
+
+PostgreSQL connectivity (`pkg/postgres` shape):
+
+- `MAIL_POSTGRES_PRIMARY_DSN`
+- `MAIL_POSTGRES_REPLICA_DSNS`
+- `MAIL_POSTGRES_OPERATION_TIMEOUT`
+- `MAIL_POSTGRES_MAX_OPEN_CONNS`
+- `MAIL_POSTGRES_MAX_IDLE_CONNS`
+- `MAIL_POSTGRES_CONN_MAX_LIFETIME`
 
 SMTP provider:
 
@@ -157,8 +168,9 @@ Templates and workers:
 - `MAIL_STREAM_BLOCK_TIMEOUT`
 - `MAIL_OPERATOR_REQUEST_TIMEOUT`
 - `MAIL_IDEMPOTENCY_TTL`
-- `MAIL_DELIVERY_TTL`
-- `MAIL_ATTEMPT_TTL`
+- `MAIL_DELIVERY_RETENTION`
+- `MAIL_MALFORMED_COMMAND_RETENTION`
+- `MAIL_CLEANUP_INTERVAL`
 
 Telemetry:
 
@@ -174,13 +186,11 @@ Telemetry:
 ## Runtime Notes
 
 - `MAIL_REDIS_COMMAND_STREAM` is the only Redis key override that currently
-  changes runtime behavior
+  changes runtime behavior; durable mail state otherwise lives in PostgreSQL
 - `MAIL_SMTP_INSECURE_SKIP_VERIFY` is a local-development escape hatch for
   self-signed SMTP capture only and should remain disabled in production
-- attempt-schedule and dead-letter key overrides are parsed but not yet wired
-  into Redis adapters
-- retention overrides are parsed but storage still uses the fixed `7d`, `30d`,
-  and `90d` values
+- the SQL retention worker is the only periodic durable cleanup; PostgreSQL
+  indexes are maintained by the engine
 - template catalog parsing is eager and immutable
 - auth deliveries in `MAIL_SMTP_MODE=stub` surface as `suppressed`
 - auth deliveries in `MAIL_SMTP_MODE=smtp` surface as `queued` and later move