feat(server): add rollback-safe revision retention

[dmuiX]

Summary

Add an opt-in, rollback-safe retention tool for server save revisions.

The default invocation is a read-only dry run. --apply keeps:

• the newest 10 valid revisions per user/title;
• one revision per day for the last 30 days;
• one revision per calendar month for older data.

Invalid archives and valid revisions outside that policy are marked R and moved atomically to a timestamped quarantine directory. They are not unlinked. The tool also copies metadata.sqlite before changing it, leaves pending revisions untouched, and rolls moved files back if the database transaction fails.

Why

The current server keeps every completed revision indefinitely while the client normally restores only the newest one. An hourly backup schedule can therefore retain many near-identical archives per title. A bounded history is still useful for rollback, but unlimited growth is not.

Safety

• dry-run by default;
• validates ZIP structure, paths, duplicate entries, decompression/CRC and the presence of saves/;
• never deletes blobs during apply;
• preserves metadata and blobs for rollback;
• ignores pending uploads;
• tests cover dry-run immutability, policy selection, invalid archives, pending revisions, database backup and quarantine behavior.

Validation

pytest -q: 18 passed.