feat: ephemeral-document cleanup (per-workflow blob + Temporal purge)

[alex-struk]

Summary

Adds an opt-in, per-workflow ephemeral policy. When a workflow's config declares metadata.ephemeral, documents it processes are purged once they reach a terminal status — blob files and/or the Temporal execution record are deleted per the policy — while the OCR result in Postgres is retained so clients can still poll it.

Configured entirely on the workflow: no global flag, no per-group setting.

metadata.ephemeral values

Value	Effect
true	delete both blob files and the Temporal execution record
{ "files": true, "temporalRecord": false }	delete only the targets set to true
false / absent	not ephemeral — nothing deleted (default)

What's included

• EphemeralDocumentCleanupService — @Cron(EVERY_MINUTE) janitor; per-document failures isolated; idempotent (safe to retry).
• TemporalClientService.deleteWorkflowExecution — idempotent on NOT_FOUND.
• documents.purged_at marker (stops reprocessing; row + ocr_results kept) + partial index documents_purge_scan_idx (workflow_config_id, status) WHERE purged_at IS NULL so the scan stays cheap at high volume.
• DB query matches any opted-in target and returns each doc's policy.
• Docs: docs-md/ephemeral-document-cleanup.md.

Migrations

• 20260623000000_add_document_purged_at
• 20260624000000_add_documents_purge_index (partial index — Prisma can't express it in schema; managed via raw SQL)

Verification

• 201 backend tests pass; type-check + biome clean.
• Verified locally end-to-end against the real OCR pipeline:
  • ephemeral: true → blobs and Temporal record deleted, OCR text retained.
  • { files: true, temporalRecord: false } → blobs deleted, Temporal record kept, OCR text retained.
  • In-progress (non-terminal) and non-ephemeral docs left untouched.

🤖 Generated with Claude Code