Add retention policy for device_events and notifications

Purges records older than a configurable window (default 365d) once per day.
Also adds a composite index on device_events(mac_address, created_on DESC) for
efficient scan history queries at scale, and fixes a non-deterministic pagination
order by adding id as a tiebreaker to ORDER BY.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/settings.rs

@@ -48,6 +48,19 @@ pub struct WebServer {
     pub api_key: String,
 }
 
+#[derive(Debug, Deserialize, Clone)]
+pub struct Retention {
+    pub window: DurationString,
+}
+
+impl Default for Retention {
+    fn default() -> Self {
+        Retention {
+            window: DurationString::try_from("365d".to_string()).unwrap(),
+        }
+    }
+}
+
 #[derive(Debug, Deserialize, Clone)]
 pub struct Settings {
     pub database: Database,
@@ -56,6 +69,8 @@ pub struct Settings {
     pub timings: Timings,
     pub notifications: Notifications,
     pub web_server: WebServer,
+    #[serde(default)]
+    pub retention: Retention,
 }
 // End configuration structure
 // -----------------------------------------------------------