Keep rotated log files for a set number of days

Personal-data catalog spec, default D1 (settled 2026-09-28): log files
were never deleted. inbuxa:LogSettings.keepForDays says how many days
rotated log files are kept; unset (null) keeps every file, as before,
and a new install sets 30 days.

It is a fork-owned setting, stored under T + l as audit retention is,
not a field on x:TracerLog: that object is also stored inside
x:Bootstrap with a field after it, so a new field would change
x:Bootstrap's stored format. Server-level, with the tracers'
permissions (sysTracerGet, sysTracerUpdate); changes are in the audit
log, before and after.

Log files are local, so every node deletes its own: hourly, and at once
when the setting changes on that node. Only regular files named
<prefix>.<something> in each enabled log tracer's directory, last
changed more than the limit ago, are removed; the file being written is
never that old, and nothing else in the directory is touched. Minimum
one day. The catalog classifies inbuxa:LogSettings and points the log
file's retention at it.

Tested: unit tests for the file rule (only this log's old files; the
current file, other files and directories stay) and a purge on disk;
the system suite, which reads, sets, refuses zero, restores null and
checks the audit records; fork checks.

resources/privacy/catalog.toml

@@ -161,6 +161,10 @@ recentLegacyUse = ["identifier", "metadata"]
 file = "inbuxa_ai_limits.rs"
 default = "none"
 
+[object."inbuxa:LogSettings"]
+file = "inbuxa_log_settings.rs"
+default = "none"
+
 # ---------------------------------------------------------------------------
 # Sources that are no object. Settings are `<object>.<property>`: a schema
 # field object, or one of inbuxa's own.
@@ -202,11 +206,12 @@ categories = ["network", "identifier", "metadata"]
 whose = ["correspondent", "holder", "administrator"]
 where = ["log-file"]
 scope = "server"
-retention = "unbounded"
+# Unset, every file is kept; a new install keeps 30 days
+retention = { setting = "inbuxa:LogSettings.keepForDays" }
 enabled_by = ["x:TracerLog.enable"]
 captures = ["x:TracerLog.level", "x:TracerLog.events", "x:EventTracingLevel.level"]
 leaves_host = false
-written_by = ["crates/common/src/telemetry/tracers/log.rs"]
+written_by = ["crates/common/src/telemetry/tracers/log.rs", "crates/services/src/inbuxa_log_retention.rs"]
 
 [source."console-and-journal"]
 categories = ["network", "identifier", "metadata"]