Delete guest accounts left idle for five days

The app had no cleanup of any kind: in multi-user mode every first visit
mints a users row, so the demo has been accumulating one permanent account
per visitor along with everything they generated.

cleanup.py sweeps guests idle for AIDND_GUEST_RETENTION_DAYS (default 5),
once at startup and then every few hours. Startup is the load-bearing
trigger — the free tier sleeps after ~15 minutes, so a long timer rarely
gets to fire.

Idle is COALESCE(last_seen_at, created_at), not last_seen_at: _touch only
writes that column hourly, and a guest minted by /auth/me has it NULL until
its second request, so the simpler query would have deleted brand-new
visitors mid-session.

It's one Core DELETE rather than db.delete(user), which would SELECT every
adventure, action and memory into Python purely to delete them — the same
egress pattern as the 189x fix. Every FK from users down is ON DELETE
CASCADE, so the database does the whole graph and returns a count.

The filter requires is_guest AND email IS NULL, so registered users (who
upgrade in place) and local mode's implicit user are both out of reach, and
is_public is output-only so a guest can never own content another user can
see. Session cookies have no expiry and can outlive a swept row; that path
401s and the frontend's existing retry re-mints a session.

Guests are told: /auth/me serves guest_retention_days and the signup modal
states the window, sourced from the server so it can't drift from what is
enforced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7

backend/app/main.py

@@ -1,4 +1,5 @@
 import os
+from contextlib import asynccontextmanager
 from pathlib import Path
 
 from fastapi import FastAPI
@@ -6,6 +7,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from starlette.exceptions import HTTPException as StarletteHTTPException
 
+from . import cleanup
 from .auth import MULTI_USER
 from .database import engine
 from .limits import BodySizeLimitMiddleware
@@ -24,6 +26,18 @@ CORS_ORIGINS = [
     if o.strip()
 ] or ["http://localhost:5173", "http://127.0.0.1:5173"]
 
+@asynccontextmanager
+async def lifespan(_app: FastAPI):
+    # Sweeps once on boot, then on an interval. Booting is the reliable
+    # trigger on Render's free tier, where the service sleeps after ~15
+    # minutes and a long-running timer rarely gets to fire.
+    sweeper = cleanup.start_sweeper()
+    try:
+        yield
+    finally:
+        await cleanup.stop_sweeper(sweeper)
+
+
 # The interactive API docs stay local-only: in multi-user mode they just hand
 # strangers a map of the API surface.
 app = FastAPI(
@@ -31,6 +45,7 @@ app = FastAPI(
     docs_url=None if MULTI_USER else "/docs",
     redoc_url=None,
     openapi_url=None if MULTI_USER else "/openapi.json",
+    lifespan=lifespan,
 )
 
 app.add_middleware(