Feat: Evidence Hub Retention

[Br0wnHammer]

Describe your changes

Adds a configurable retention policy for Evidence Hub records: an org level default and per evidence override compute expiry dates, and a daily BullMQ sweep flags expired records and notifies the reviewer or org admins. Soft archival of expired evidence is available behind explicit env and org opt ins, with expired and expiring soon indicators in the Evidence Hub list.

Fixes #4582

Please ensure all items are checked off before requesting a review:

• I deployed the code locally.
• I have performed a self-review of my code.
• I have included the issue # in the PR.
• I have labelled the PR correctly.
• The issue I am working on is assigned to me.
• I have avoided using hardcoded values to ensure scalability and maintain consistency across the application.
• I have ensured that font sizes, color choices, and other UI elements are referenced from the theme.
• My pull request is focused and addresses a single, specific feature.
• If there are UI changes, I have attached a screenshot or video to this PR.
• If I added or modified an API endpoint, the change is reflected in the generated OpenAPI spec (npm run generate:swagger).
• If the endpoint requires authentication, it uses authenticateJWT and the generated spec declares bearerAuth security.
• I ran npm run check:api-drift and committed the regenerated swagger.yaml and endpoints.ts.
• If this PR adds or modifies an organization-scoped table, the tenant isolation registry and test matrix are updated. See the tenant isolation runbook for details.

[github-actions]

✅ Coverage Gate Passed

All coverage thresholds are met.