[Cron] Implement scheduled cleanup job for expired tokens and stale data (issue #66)

[Emmanard]

Summary

Closes #66.

Implements four scheduled DB maintenance jobs via a new cron.service.ts + cleanup.cron.ts, with Prometheus counter metrics and full unit-test coverage.

• Expired sessions (hourly) — DELETE FROM user_sessions WHERE expires_at < NOW()
• Expired password-reset tokens (hourly) — DELETE FROM password_reset_tokens WHERE expires_at < NOW()
• Old notifications (daily 02:00) — soft-delete notification_jobs rows older than 90 days via deleted_at
• Failed distributions (weekly Sun 03:00) — set archived_at on distributions rows with status='failed' older than 30 days
• All four jobs increment prom-client Counters exported from new metrics.service.ts

Changed files

File	Purpose
migrations/1719360000000_add-cleanup-tables.js	Adds user_sessions, password_reset_tokens, distributions tables; adds deleted_at to notification_jobs
src/db/schema.ts	Drizzle definitions + inferred types for new tables; deleted_at on notification_jobs
src/services/metrics.service.ts	Four prom-client Counters — one per cleanup job
src/services/cron.service.ts	CronDbAdapter interface + four job functions; each increments its counter
src/cron/cleanup.cron.ts	node-cron schedules with overlap guards and CLEANUP_CRON_DISABLED env gate
src/index.ts	Registers startCleanupCron() alongside existing crons
tests/services/cron.service.test.ts	11 unit tests: correct adapter method called, correct counter incremented, job isolation
package.json	Adds prom-client ^15.1.3

Test plan

• jest tests/services/cron.service.test.ts — 11/11 passing
• tsc --noEmit — zero new errors in changed/created files
• Run DB migration against staging: npm run migrate up
• Verify cron log lines appear hourly/daily/weekly in deployed logs
• Confirm Prometheus counters visible at /metrics endpoint (requires wiring metrics route — follow-up)

Notes

• The three new tables (user_sessions, password_reset_tokens, distributions) are clean-room additions. The auth service currently uses Redis/in-memory for sessions and reset tokens; a follow-up PR can dual-write to DB to populate these tables.
• Set CLEANUP_CRON_DISABLED=true to gate all four jobs off in any environment.

closes #463