add keep_days to prune old originals from .processed/

[noxend]

Closes #12.

.processed/ archives every original recording forever right now, with no cleanup mechanism at all. keep_days deletes originals once they're this many days old; 0 (the default) keeps the current behavior exactly.

Went through an adversarial pass before opening this, since the failure mode of a prune feature is silently destroying someone's original recordings. Two real bugs came out of that and are fixed here, not left as follow-ups:

• Integer overflow. A large-but-well-formed keep_days (roughly 15+ digits) overflowed the cutoff arithmetic and wrapped it into the future, which pruned everything in .processed/, including a file archived in the same run. Fixed with a 3650-day cap, matching how fps is already capped. A plain <= 3650 check on its own turned out to have the same hole: a long enough digit string gets truncated by zsh's arithmetic before the comparison runs, so the value is bounded by digit count first, before any arithmetic touches it.
• A failed prune was logged as a successful one. rm -f on a locked or permission-denied file still failed, but the log said "pruned" regardless, since the log line was written before the removal was attempted. Now it's written only once rm -f actually succeeds.

Also fixed along the way: mv preserves a file's original mtime on the same volume, so an old recording dropped in and archived today would have been pruned in that same run, before ever sitting in .processed/ for the length of time keep_days implies. The archive step now stamps the file with today's date.

Two low-severity gaps found in the same pass are filed separately rather than fixed here: #15 (symlinks in .processed/ are never pruned, no data-loss risk either way) and #16 (pruning a large one-time backlog is slow, correctness is fine). A third, a literal newline inside a filename splitting a log line, isn't realistic for anything a screen recorder actually produces and isn't tracked separately.

104 tests passing (was 100 on main), shfmt clean, smoke-tested against a live install.