Phase 2d — gateway_jobs retention (Janitor goroutine)

Periodic cleanup goroutine, started alongside the worker when DATABASE_URL
is set. Three concerns :

- DELETE rows with status='done' older than QUEUE_DONE_RETENTION (default
  168h / 7 days). Past success rows have no value beyond debug runway.
- UPDATE rows stuck in status='running' for more than QUEUE_STUCK_TIMEOUT
  (default 30m) back to 'pending' so a worker can retry. Handles the
  case of a pod crashing mid-job (without this, jobs stay orphaned forever).
- 'dead' rows are NEVER auto-purged (volume negligible, kept for forensics).

Configurable via env :
- QUEUE_DONE_RETENTION (default 168h)
- QUEUE_STUCK_TIMEOUT  (default 30m)
- QUEUE_JANITOR_INTERVAL (default 1h)

The janitor runs once immediately at startup (recovers anything orphaned
by the previous pod before opening for new traffic), then ticks on the
interval.

Queue interface gains PurgeDone + RecoverStuck — both use Postgres'
make_interval(secs) for safe parameterization.

4 new unit tests via fakeQueue mock (47 total, race clean).

main.go

@@ -106,6 +106,14 @@ func runServer() {
 	if queue != nil {
 		worker := NewWorker(queue, registry, tg)
 		go worker.Run(ctx)
+
+		// Phase 2d — janitor : purge done > QUEUE_DONE_RETENTION (default 7d),
+		// recover stuck running > QUEUE_STUCK_TIMEOUT (default 30m), runs every
+		// QUEUE_JANITOR_INTERVAL (default 1h). All overridable via env.
+		doneRet := envDuration("QUEUE_DONE_RETENTION", defaultDoneRetention)
+		stuckTO := envDuration("QUEUE_STUCK_TIMEOUT", defaultStuckTimeout)
+		jInt := envDuration("QUEUE_JANITOR_INTERVAL", defaultJanitorInterval)
+		go NewJanitor(queue, doneRet, stuckTO, jInt).Run(ctx)
 	}
 
 	srv := &http.Server{
@@ -140,3 +148,19 @@ func envOr(key, fallback string) string {
 	}
 	return fallback
 }
+
+// envDuration reads a Go duration from env (e.g. "168h", "30m") or returns
+// the fallback if unset / unparseable. Logs a warning on parse error so the
+// operator notices a typo without losing the deployment.
+func envDuration(key string, fallback time.Duration) time.Duration {
+	raw := os.Getenv(key)
+	if raw == "" {
+		return fallback
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil || d <= 0 {
+		log.Printf("%s=%q invalid, defaulting to %s", key, raw, fallback)
+		return fallback
+	}
+	return d
+}