Revise cleanup retention

[jhogarthtrijicon-debug]

use simple age-based retention (21 days), keep the Sunday cleanup schedule, and make the cleanup code use the OAuth refresh token. Also removing the unused GFS-only logging from this workflow so it does not claim to enforce a policy the current code does not implement.

[OmarRao]

@
Thanks for the detailed report — implemented in #36 (merged to `main`).

• Simple age-based retention, 21 days — RETENTION_DAYS now defaults to 21 (was 90); no tiered policy.
• Sunday cleanup schedule kept — cron: "0 3 * * 0" unchanged.
• OAuth refresh token — src/cleanup/index.js now authenticates via GoogleDriveClient.createAuthClient(clientSecret, token) (same flow as backup/restore), replacing the invalid GoogleAuth keyFile on the client-secret.
• Removed the GFS theater — dropped the retention_policy input, the GFS_* env vars, and the log lines that claimed a Grandfather-Father-Son policy the code never enforced. Docs (README + USER GUIDE §8.3/FAQ/SOX) were corrected to match.

One deliberate nuance kept: the cleanup is still chain-aware — it will not delete a base/intermediate git bundle that a retained delta-backup chain still needs to restore. That is not a retention policy, just a data-loss safeguard for INCREMENTAL_MODE=delta users; plain (non-delta) sessions are unaffected and expire purely by age.

Override the window anytime: gh workflow run cleanup.yml -f retention_days=30.

— Omar
@