feat(retention): administer policies and attributed holds

[TusanHomichi]

Operators can now configure immutable retention policy versions and administer attributed holds through a dedicated Retention page. A new explicit manage_retention grant controls installation-wide policy and hold access; no role bundle includes it. Existing user administrators grant or revoke it with an atomic reason, authority event, and audit event.

Policy changes require the expected current version. Holds use typed installation, enrollment, or record scopes and preserve creation, replacement, and release history. Replacement and predecessor release commit together; revoked authority, stale policies, concurrent hold changes, and injected audit failures have integration proof. Migration 0015 enforces append-only history, vocabulary, scope shape, policy succession, and attributed replacement pairing.

ADR 0020 defines the durable contracts. Focused retention services own vocabulary, policies, holds, and explicit authority. Shared web request/error transport moves into api/transport.ts with compatible legacy exports; retention has its own client and components. The older enrollment migration test now permits additive schema owners while asserting every preexisting object remains unchanged.

This completes the administration stage only. Confirmed destruction, complete copy and backup/restore scope, independently retained tombstones, and portable disposition evidence remain in #64. Saving a policy or releasing a hold deletes nothing.

Validation at 61da869:

• Web: npm ci, npm run check (zero errors/warnings), and npm run build passed. Existing low-severity dependency advisories remain tracked in web(deps): resolve SvelteKit cookie audit advisory #54.
• Rust: cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (165 passed), and cargo build -p consolebook-server passed. Local compilation used two jobs and tests used two threads.
• npx playwright install chromium and npm run e2e -- --workers=2 --trace retain-on-failure: all nine Chromium scenarios passed. The first run passed eight scenarios; the new scenario reached its final revoke step and failed on an ambiguous test label selector. That selector now uses exact matching; the complete rerun passed.

Closes #65. Refs #64, #59, #44.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:53:11.696963Z	61da869	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.