fix(sync): track cleanup state to stop re-deleting log rows and bound SyncQueue

- access_reader.delete_log_ids returns the actual rows deleted (was None).

- sql_writer.mark_cleaned flips applied queue rows to 'cleaned' (sets CleanedAt) after their Access log rows are physically removed, so the same IDs are never deleted twice.

- sql_writer.purge_cleaned removes 'cleaned' rows older than a retention window (default 24h) so SyncQueue stops growing without bound.

- cleanup.cleanup_file marks rows cleaned after a successful delete and returns the real delete count, so the service log reports honest 'cleaned N' instead of a constant.

- service.cycle calls purge_cleaned once per pass; config adds cleaned_retention_hours (default 24).

- sql/01_sync_queue.sql adds CleanedAt column + IX_SyncQueue_Cleaned idempotently.

- tests: unit coverage for mark_cleaned/purge_cleaned/delete_log_ids return count; assert cycle purges each pass.

tests/test_service.py

@@ -47,6 +47,7 @@ def test_cycle_continues_on_capture_error_and_still_applies_and_cleans():
         assert mcapture.call_count == 2          # both files attempted (bad swallowed)
         writer_inst.call_apply.assert_called_once()  # apply still called
         assert mcleanup.call_count == 2          # cleanup attempted for both files
+        writer_inst.purge_cleaned.assert_called_once()  # cleanup bookkeeping
         writer_inst.close.assert_called()        # writer closed in finally