v0.5.1: automatic Trash purge (cron-less background thread)

Trashed artifacts past a ~3-day retention window are now purged automatically.

- storage.purge_expired_trash(): removes trash older than TRASH_RETENTION
  (all users), tolerant of already-gone rows (concurrent-safe).
- spawn_trash_purge(): runs it on a daemon thread (manages/closes its own DB
  connection), triggered by each delete so it's cron-less and off the request
  thread. Inline fallback when AGENTFEED_ASYNC_PURGE is off (tests).
- Wired into both delete paths (API + session). Manual Empty Trash unchanged.
- Tests: purge removes expired-only; delete triggers the purge. 152 passing;
  live delete verified with the thread enabled (204, server healthy).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

daybook_project/__init__.py

@@ -1,4 +1,4 @@
 # Single source of truth for the app version. Bump this, commit, then tag the
 # commit `vX.Y.Z` and deploy. Surfaced on Settings -> About and in
 # GET /api/capabilities ("version").
-__version__ = "0.5.0"
+__version__ = "0.5.1"

daybook_project/settings.py

@@ -19,6 +19,10 @@ AGENTFEED_KEY_PROVISIONING_API = os.environ.get(
     "AGENTFEED_KEY_PROVISIONING_API", ""
 ).lower() in {"1", "true", "yes", "on"}
 
+# Purge expired Trash off the request thread (triggered by deletes, no cron).
+# Tests override this to run inline so purge behavior is deterministic.
+AGENTFEED_ASYNC_PURGE = True
+
 # Needed when running behind a TLS-terminating reverse proxy (Apache/Nginx/etc.):
 # Django otherwise thinks every request is plain HTTP, which breaks CSRF checks
 # on login/POST. The proxy must forward X-Forwarded-Proto: https.