feat(rotation): Phase 4 — retired-key cleanup scheduler (#72) - #131

Summary

Stacked on #130 (Phase 3). Adds a background sweeper that walks every enabled box on a tick and removes any keys whose retired_at + overlap window has passed — completing the install→use→remove three-phase rotation cycle without operator intervention.

Scope note: Phase 4 in the original plan also covered auto-rotation on a schedule (off by default, configurable cadence). That needs a new global-settings surface in the dashboard (no app-level config table exists today; only user_preferences), which is its own design pass. Deferring the auto-rotate scheduler to a follow-up so this PR stays focused on the piece that's actually needed regardless of whether auto-rotation is enabled. With this PR shipped, an operator clicking the Phase 3 Rotate button gets the old key cleaned up automatically a day later.

Implementation

• services/agent_keyring/cleaner.go — RetiredKeyCleaner runs as a goroutine off the dashboard's process-lifetime context
• Hourly tick (CleanerInterval) — short enough that a 24h-overlap rotation cleans up within a few hours of its target, long enough that the sweep is cheap
• Immediate sweep on start so a freshly-deployed dashboard catches up on retired keys left from manual rotations while the prior instance was down
• Per-box failures logged but don't halt the sweep
• Wired into cmd/server/main.go startup alongside the existing alert evaluator

Test plan

• Both cleaner tests pass: removes a retired key on tick / no-op when nothing is retired
• Manual: rotate a box; wait an hour (or set CleanerInterval low for testing); confirm the old kid is removed from both the agent's /api/v1/system/keyring and the dashboard's DB
• On dashboard restart, immediate sweep fires (log line "retired-key cleaner started")
• No regressions in existing tests

Stack

Phase 4 of 5. Base: feature/issue-72-phase-3-rotate-ui (#130).

Closes part of #72.

🤖 Generated with Claude Code