fix: accept zero retention limits, retire Store() for typed accessors

Phase 8 (PROJECT_REVIEW_PLAN.md 8.1): 0 in MaxLogFiles/MaxLogAgeDays now
means "keep everything" end to end. runner.CleanupLogs already treated
<= 0 as disabled; validateConfig, the Settings form, and
loadOrCreateConfig's backfill were the only things making that state
unreachable.

Phase 9 (1.1, rolling up 1.2, 1.3, 7.3): added Service.Config() and
Service.Paths(), copying under mu, and converted every UI site that read
Service state through the raw *storage.Store returned by Store() (now
removed). jobs_view's pause control is now driven by refreshView reading
svc.Config().Paused on every event instead of only mirroring its own tap
handler, which makes it an actual consumer of SchedulerStateChanged.
mainwindow's event listener is a real type switch, and events.go's doc
comment no longer claims a compiler exhaustiveness check Go doesn't have.
Unexported the redundant SetAutostart/AutostartStatus package functions
in platform/autostart now that only the Manager methods are used outside
the package.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -51,6 +51,11 @@ the app icon (experimental).**
   gets slower the longer the app has been running. Measured on 5000 accumulated
   records, one History redraw went from **15.8 ms to 0.9 ms**; at the new cap
   the width rescan alone accounted for 1.5 ms of every redraw.
+- **Max log files and max log age days now accept 0, meaning "keep
+  everything."** Log cleanup already supported disabling either policy; the
+  Settings form and the Service validator rejected the value that would have
+  turned it on. A config that already set either to 0 is no longer silently
+  rewritten back to the 100/30 defaults on load.
 
 **Jobs:**
 

docs/STANDARDS.md

@@ -71,6 +71,14 @@ change to their shape has to stay compatible on its own.
   = 0) and is overridable per job (`Job.TimeoutSeconds *int`: unset = inherit the
   global default, 0 = no timeout, positive = seconds). Neither zero may be
   normalized away on load — 0 is a value, not a missing field.
+- **`Config.MaxLogFiles` and `Config.MaxLogAgeDays` of 0 mean "keep everything",
+  not "unset".** `runner.CleanupLogs` already treated `<= 0` as "policy
+  disabled"; `app.validateConfig` and the Settings form now accept 0 (only a
+  negative count is rejected), and `storage.loadOrCreateConfig` no longer
+  backfills 0 to 100 / 30 — a config written before either field existed still
+  picks up the default because `json.Unmarshal` leaves an absent key holding
+  whatever `DefaultConfig()` set, the same mechanism `DefaultTimeoutSeconds`
+  relies on.
 - **A `StartOnly` process is expected to outlive GoSentry.** The option exists to
   launch something and let go of it, so the runner builds that invocation on
   `context.Background()`, not on the application's lifecycle context: quitting