feat(PROJ-34): Retention-Tab + pro-Mandant Aufbewahrungsfristen

- tenantstore: retention_days Spalte, GetRetentionDays/SetRetentionDays
- storage.Save(): per-tenant retention überschreibt globale config
- API: GET /api/admin/retention, PUT /api/admin/tenant/{id}/retention
- Frontend: RetentionTab mit globaler Policy-Anzeige, Mandanten-Tabelle,
  Bearbeiten-Dialog und Purge-Button (superadmin only)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/server.go

@@ -78,8 +78,9 @@ type Server struct {
 	tenantStore       *tenantstore.Store
 	tenantLdapStore   *ldapcfg.TenantStore
 	idxMgr            *index.TenantIndexManager
-	appVersion    string
-	moduleVersions map[string]string
+	appVersion           string
+	moduleVersions       map[string]string
+	globalRetentionDays  int // from storage config (PROJ-34)
 }
 
 // SetSMTPDaemon wires the SMTP daemon into the API server after construction.
@@ -111,6 +112,11 @@ func (s *Server) SetVersion(appVersion string, modules map[string]string) {
 	s.moduleVersions = modules
 }
 
+// SetGlobalRetentionDays wires the global retention_days from storage config into the API server.
+func (s *Server) SetGlobalRetentionDays(days int) {
+	s.globalRetentionDays = days
+}
+
 // New creates and wires up a new API server.
 func New(
 	cfg config.APIConfig,
@@ -170,8 +176,10 @@ func (s *Server) routes() {
 	// SEC-17: Security fix actions require superadmin, not just domain_admin.
 	s.mux.HandleFunc("POST /api/admin/security/fix", s.auth(s.requireRole(userstore.RoleSuperAdmin, s.handleSecurityFix)))
 
-	// PROJ-34: Retention purge — superadmin only
+	// PROJ-34: Retention — superadmin only
 	s.mux.HandleFunc("POST /api/admin/purge", s.auth(s.requireRole(userstore.RoleSuperAdmin, s.handlePurge)))
+	s.mux.HandleFunc("GET /api/admin/retention", s.auth(s.requireRole(userstore.RoleSuperAdmin, s.handleGetRetention)))
+	s.mux.HandleFunc("PUT /api/admin/tenant/{id}/retention", s.auth(s.requireRole(userstore.RoleSuperAdmin, s.handleSetTenantRetention)))
 
 	// PROJ-33: IMAP mode settings — domain_admin only
 	s.mux.HandleFunc("GET /api/admin/settings/imap-mode", s.authAdmin(s.handleGetIMAPMode))