Add send-log retention days to panel Settings.

Global administrators can set delivery journal retention (7-365 days) in SQLite;
SEND_LOG_RETENTION_DAYS seeds the initial default and the log-tailer re-reads
the value every prune cycle without a restart.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/view/templates/deliveries.html

@@ -8,6 +8,10 @@
 {{define "content"}}
 <h1>Deliveries</h1>
 
+<p class="muted">Rows older than {{.SendLogRetentionDays}} days are deleted
+automatically.{{if .IsGlobal}} Change retention on
+<a href="/settings">Settings</a>.{{end}}</p>
+
 <div class="card">
   <h2>Filter</h2>
   <form method="get" action="/deliveries">

internal/web/view/templates/settings.html

@@ -77,10 +77,23 @@
   </div>
 </div>
 
+<div class="card" id="deliveries-retention">
+  <h2>Deliveries</h2>
+  <p class="muted">How long rows on <a href="/deliveries">Deliveries</a> are
+  kept before the background sweep deletes them — the main driver of
+  <code>/data</code> growth over time. Does not affect <code>mail.log</code>
+  rotation (fourteen daily files).</p>
+
+  <label for="send_log_retention_days">Send log retention (days)</label>
+  <input id="send_log_retention_days" name="send_log_retention_days" type="number"
+         min="7" max="365" step="1" required
+         value="{{.FormSendLogRetentionDays}}">
+</div>
+
 <button type="submit">Save changes</button>
-<p class="muted">Leave both new-password fields empty to change the username
-or DMARC address only. Changing the password signs out every other session;
-this one stays signed in.</p>
+<p class="muted">Leave both new-password fields empty to change the username,
+DMARC address, or send log retention only. Changing the password signs out
+every other session; this one stays signed in.</p>
 </form>
 {{else}}
 <div class="card narrow">