Add retention diagnostics and delivery audit export

[crypt0rr]

What changed

• Add an administrator-only machine-readable diagnostics endpoint at /admin/diagnostics.json.
• Add a paginated delivery-audit CSV export at /admin/retention/export.
• Keep exports formula-safe and exclude encrypted destination URLs, credentials, and sensitive provider details.
• Add regression coverage for authorization, diagnostics redaction, and CSV export.
• Document the v0.45.0 retention/diagnostics workflow.
• Align local lint and vulnerability checks with the pinned Docker Go toolchain.

Why

This provides safe operational visibility and a practical audit export while keeping retention non-destructive and preserving the existing encrypted database backup as the authoritative recovery artifact.

Validation

• gofmt, go vet, normal tests, and race tests
• golangci-lint v2.12.2
• govulncheck v1.6.0
• 80.3% total coverage
• Docker test/runtime builds
• container smoke test covering setup, login, follow, manual sync, readiness, persistence, and graceful shutdown