Add configurable bounded retention draining and backlog visibility for busy sites

Problem/Motivation

Each cron invocation currently removes at most 250 expired history rows. At higher intake rates the backlog can grow faster than ordinary cron removes it, a limitation already documented in the README.

Proposed resolution

Add a bounded maintenance command or configurable time/row budget that can drain several cleanup batches, plus backlog/oldest-expired visibility. Keep conservative defaults and durable suppression/audit protections.

Acceptance criteria

• Measure representative workloads before changing indexes or batch sizes and publish throughput assumptions.
• Bound wall time and row count, resume safely after interruption and handle overlapping cron/CLI execution.
• Delete only eligible event history; preserve suppression evidence, release markers and separately retained operator audits.
• Report approximate or bounded-cost backlog measurements without expensive unbounded scans on every request.
• Test more than one batch, zero retention, exact expiry boundaries and concurrent intake across the verified database drivers.

Scope and dependencies

Optional follow-up after stable release; not a blocker for #3621224: Complete the 1.0.0 stable release verification gates. Builds on #3621134: Bound cron cleanup and index normalized suppression lookups; the completed original issue remains fixed.