Add submission management, export, and retention

[quangshuynh]

Summary

Adds authenticated submission retrieval, export, and explicit retention cleanup.

Included

• paginated submission listing
• submission detail with stored field values
• endpoint and time-range filtering
• JSON export
• CSV export with repeated-value preservation
• CSV formula-injection protection
• configurable retention policy
• dry-run and batched retention CLI
• migration 0005
• preserved delivery and attempt history after submission cleanup

Retention semantics

A submission is eligible for cleanup only when it is past the retention cutoff and:

• has no delivery, or
• its delivery is already delivered

Pending, processing, and failed deliveries retain their submissions because worker delivery and manual replay still require the stored payload.

Deleting a retained submission unlinks its delivery history instead of deleting it.

Current limitations

• failed deliveries can pin submissions indefinitely
• delivery and attempt history has no retention policy
• no per-submission delete API
• exports may contain sensitive user-provided data
• submitted values are not encrypted at rest