fix(sync): track cleanup state to stop re-deleting log rows and bound SyncQueue

- access_reader.delete_log_ids returns the actual rows deleted (was None).

- sql_writer.mark_cleaned flips applied queue rows to 'cleaned' (sets CleanedAt) after their Access log rows are physically removed, so the same IDs are never deleted twice.

- sql_writer.purge_cleaned removes 'cleaned' rows older than a retention window (default 24h) so SyncQueue stops growing without bound.

- cleanup.cleanup_file marks rows cleaned after a successful delete and returns the real delete count, so the service log reports honest 'cleaned N' instead of a constant.

- service.cycle calls purge_cleaned once per pass; config adds cleaned_retention_hours (default 24).

- sql/01_sync_queue.sql adds CleanedAt column + IX_SyncQueue_Cleaned idempotently.

- tests: unit coverage for mark_cleaned/purge_cleaned/delete_log_ids return count; assert cycle purges each pass.

sql/01_sync_queue.sql

@@ -40,3 +40,23 @@ BEGIN
         ON dbo.SyncQueue(Status, TargetSchema, TargetTable);
 END
 GO
+
+-- Cleanup bookkeeping: track when a queue row's Access log counterpart has
+-- been physically deleted, so cleanup never re-deletes the same IDs and the
+-- table can be purged to bound its growth.
+IF NOT EXISTS (SELECT 1 FROM sys.columns
+               WHERE object_id = OBJECT_ID('dbo.SyncQueue')
+                 AND name = 'CleanedAt')
+BEGIN
+    ALTER TABLE dbo.SyncQueue ADD CleanedAt datetime2 NULL;
+END
+GO
+
+IF NOT EXISTS (SELECT 1 FROM sys.indexes
+               WHERE name = 'IX_SyncQueue_Cleaned'
+                 AND object_id = OBJECT_ID('dbo.SyncQueue'))
+BEGIN
+    CREATE INDEX IX_SyncQueue_Cleaned
+        ON dbo.SyncQueue(Status, CleanedAt);
+END
+GO