chore: docs retention wording, demo analytics mock cleanup, gitignore fix (#343)

* docs: clarify file retention vs saved-library persistence

FILE_MAX_AGE_HOURS only affects unsaved processing results (raw uploads
and tool outputs). Files saved to the Files library persist until the
user deletes them. Spell that out in the configuration table and the
getting-started Files section.

* chore(demo): drop removed per-user analytics from the mock API

#336 deleted the per-user analytics consent system (the DB columns, the
PUT /api/v1/user/analytics endpoint, and the consent UI in apps/web). The
demo mock still simulated them: a PUT handler, the analyticsEnabled /
analyticsConsentShownAt state fields, and analytics fields on the session
user. Nothing reads them anymore, so remove them. The current
GET /api/v1/config/analytics mock stays (that endpoint still exists).

* fix(gitignore): anchor demo ignore to root so apps/demo stays trackable

A bare 'demo' pattern matched any dir named demo, including the tracked
apps/demo workspace. New files under apps/demo were silently ignored and
lint-staged choked re-adding it. Root demo/ (the intended target) no
longer exists; anchor the rule to /demo. Build artifacts under apps/demo
stay ignored via the global dist/ and .turbo/ rules.

.gitignore

@@ -72,7 +72,7 @@ tests/benchmark/bench-limits-results-mac.jsonl
 scripts/setup-cloudflare-email.sh
 apps/videos
 remotion/
-demo
+/demo
 pentest-results/
 # Stryker mutation testing
 .stryker-tmp/

apps/demo/src/mock-api.ts

@@ -88,14 +88,12 @@ const STATE_KEY = "snapotter-demo-state";
 
 function loadState(): {
   passwordChanged: boolean;
-  analyticsEnabled: boolean | null;
-  analyticsConsentShownAt: number | null;
 } {
   try {
     const raw = localStorage.getItem(STATE_KEY);
     if (raw) return JSON.parse(raw);
   } catch {}
-  return { passwordChanged: false, analyticsEnabled: null, analyticsConsentShownAt: null };
+  return { passwordChanged: false };
 }
 
 function saveState(patch: Partial<ReturnType<typeof loadState>>) {
@@ -134,9 +132,6 @@ function matchRoute(url: string, method: string): Response | null {
         role: "admin",
         permissions: PERMISSIONS,
         mustChangePassword: !state.passwordChanged,
-        analyticsEnabled: state.analyticsEnabled,
-        analyticsConsentShownAt: state.analyticsConsentShownAt,
-        analyticsConsentRemindAt: null,
         loginMethod: "local",
         hasLocalPassword: true,
       },
@@ -179,11 +174,6 @@ function matchRoute(url: string, method: string): Response | null {
     });
   }
 
-  if (path === "/api/v1/user/analytics" && method === "PUT") {
-    saveState({ analyticsEnabled: true, analyticsConsentShownAt: Date.now() });
-    return json({ ok: true });
-  }
-
   if (path.startsWith("/api/v1/tools/") && method === "POST") {
     return json(
       {

apps/docs/guide/configuration.md

@@ -59,7 +59,7 @@ All configuration is done through environment variables. Every variable has a se
 
 | Variable | Default | Description |
 |---|---|---|
-| `FILE_MAX_AGE_HOURS` | `72` | How long temporary files are kept before automatic deletion. |
+| `FILE_MAX_AGE_HOURS` | `72` | How long unsaved processing results (raw uploads and tool outputs) are kept before automatic deletion. Files you explicitly save to the Files library are not affected and persist until you delete them. |
 | `CLEANUP_INTERVAL_MINUTES` | `60` | How often the cleanup job runs. |
 
 ### Appearance

apps/docs/guide/getting-started.md

@@ -134,6 +134,8 @@ Pipelines have unlimited steps by default.
 
 Every file you process can be saved to your **Files** library. SnapOtter tracks the full version history so you can trace every processing step from the original upload to the final output.
 
+Saving is explicit: results you save to the library are kept until you delete them, while results you process and leave unsaved are cleared automatically after 72 hours (configurable via `FILE_MAX_AGE_HOURS`).
+
 ### REST API & API Keys
 
 Every tool is accessible via HTTP: