cleanup: scheduled auto-cleanup via systemd timer (CLI + NixOS/HM module options)

[fosskar]

Motivation

Session files accumulate without bound; ssync cleanup (--keep/--before, --unnamed, dry-run by default, --apply to delete) exists but is manual. Wanted: scheduled auto-cleanup, so old sessions get pruned automatically ("run every week", "every 2 days", ...).

Proposal

Scheduling belongs to systemd (timers), not a daemon-internal scheduler.

1. CLI enablement

New subcommand (bikeshed): ssync cleanup-timer enable --every <schedule> [--keep <dur>] [--unnamed] [--agent <name>]

• installs + enables a systemd timer/service pair running ssync --config <cfg> cleanup --keep <dur> --apply (user units when the daemon runs per-user, system units otherwise)
• --every accepts 2d, 7d, weekly, or a raw OnCalendar= expression
• --keep defaults to a conservative retention (e.g. 90d) when omitted
• disable and status counterparts
• non-systemd platforms: document a cron line as fallback (the cleanup command itself is already non-interactive)

2. NixOS module

services.ssync.autoCleanup = { enable, schedule, keep, unnamed }:

• generates ssync-cleanup.service (oneshot, same User/config/package as the daemon) + ssync-cleanup.timer
• timer: OnCalendar=<schedule>, Persistent=true (machine slept through the window -> catch up), RandomizedDelaySec
• ordering: After=ssync.service (propagation is nicest with the daemon up, though deletion-while-down is settled correctly on next start)

3. Home-manager module

Same option set on the user bus (systemd.user.timers).

Semantics to state loudly (docs)

• Deletions propagate mesh-wide. Cleanup deletes local files; the daemon tombstones them and every peer deletes its copy. A timer on ONE machine prunes ALL machines - that is the feature, but it must be documented next to the option.
• One machine with a timer is enough; enabling on several is harmless (selection is idempotent) but redundant.
• The existing wipe guard (refuses deleting all of an agent's sessions, cleanup.rs plan()) stays - it also protects the timer from an empty/unmounted dir scenario.
• Artifact-dir files (0.8.0, DECISIONS adapters: amp session sync #9 amendment) inherit their session's created_at, so a session and its artifacts are always selected together.

Non-goals

• no daemon-internal scheduler
• no per-project retention policies (later, if ever)