feat(account): retention TTL reaper (2-year legal hold)

Daily background reaper purges the deletion dossier past its two-year TTL: every
retained_identities row by detached_at (covering unlink/change on live accounts too),
and — for accounts tombstoned before the cutoff — the retained feedback thread plus the
dossier PII (deleted_display_name, last_login_ip). Chat is kept (a shared game artifact)
and the tombstone row stays. Started from main next to the guest reaper. Integration
test covers the cutoff boundary and the deleted-account feedback/PII purge.

backend/cmd/backend/main.go

@@ -162,6 +162,15 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))
 
+	// Purge the account-deletion legal dossier past its retention TTL: the
+	// retained-identities journal, and the feedback thread + dossier PII of long-deleted
+	// accounts (chat is kept). Checked daily; the TTL is a two-year policy constant.
+	retentionReaper := account.NewRetentionReaper(accounts, account.RetentionTTL, logger)
+	go retentionReaper.Run(ctx, 24*time.Hour)
+	logger.Info("retention reaper started",
+		zap.Duration("interval", 24*time.Hour),
+		zap.Duration("retention", account.RetentionTTL))
+
 	// Re-evaluate moderated-chat write access when a temporary block self-expires:
 	// no operator action fires then, so the sweeper emits the chat-access-changed
 	// event for lapsed blocks and the gateway re-pushes the chat-gate command.