chore: retain daily traffic metric snapshots

[LQ458]

Summary

• add append-only daily traffic metric snapshots using the existing privacy-safe collector
• fix UTC cutoff, path, secret-permission, and atomic-write safeguards
• document private scheduling, retention, limitations, and rollback

Validation

• targeted traffic collector tests pass
• snapshot dry-run verifies idempotency, privacy, permissions, cutoff, and symlink rejection
• production dependency audit reports 0 vulnerabilities
• formatting and diff checks pass

No production service, database, media, Nginx configuration, or scheduled task is changed by this PR.