fix(retention): Pro pays for unlimited history; the cron never knew Pro existed

[lilyshen0722]

Caught by Sam while reviewing the billing work: "did we even filter user during pg data clean up?"

No. We did not.

The gap

The landing page sells "Unlimited message history — nothing expires at 30
days" as the headline Pro feature, and #875 started charging for it.
Message.deleteOlderThan filtered on exactly two things:

DELETE FROM messages
WHERE created_at < NOW() - $1::interval
  AND pod_id != ALL($2)   -- an env list of operator-pinned pods

Message age, and an env var. Nothing that knows the Pro tier exists. A paying
customer's messages were deleted on precisely the free-tier schedule.

Worse than the flat window: under storage pressure pgRetentionService steps
the window down toward a one-day floor. A Pro subscriber could have been
left with 24 hours of history while being billed to keep it forever.

Verified live before fixing — the cron is scheduled daily at 03:00 UTC, running
a 30-day window, exempting only the two showroom pods.

Exposure

Nobody has lost paid-for data. The first Pro account is hours old and has
nothing older than 30 days. The breach would have landed roughly a month after
the first paying customer's oldest message, silently, with the copy still
promising otherwise.

The fix

The mechanism the existing comment in Message.ts explicitly asked for:

Env-var rather than a pod flag, deliberately, for now: the paid tier being
designed makes retention a per-account entitlement, and THAT mechanism should
own per-pod retention when it lands.

• deleteOlderThan(days, protectedPodIds) — unioned with the env list, not
  replacing it. Operator-pinned and paid pods are exempt for different reasons
  and neither should mask the other.
• Resolved once per run and threaded through every tier including the
  step-down — that loop is the path that would otherwise walk a paying user
  to the floor, and fixing only the first call would have looked correct.
• Any Pro member protects a pod, not just its creator. A conversation with
  one free and one paying participant cannot be half-deleted, or the Pro user
  watches their own history vanish.

The property worth more than the feature

If the entitlement lookup throws, the run aborts before a single row is
deleted. Destroying paid-for data because Mongo blinked is unrecoverable;
skipping one night of cleanup is not.

Verification

Nine new/updated tests across the SQL boundary and the service. Reverted the
fix and confirmed they fail. Typecheck clean.

Related: #875, #876, #877.