feat: add GET /api/privacy/retention endpoint returning RETENTION_SCHEDULE

[mikewheeleer]

Fixes #568

The /api/privacy/retention endpoint already exists in src/routes/privacy.ts and returns RETENTION_SCHEDULE from src/pii/policy.ts.

This PR adds 8 integration tests in tests/privacy.retention.test.ts:

• Returns 200 with JSON content-type
• Response contains retentionSchedule array matching RETENTION_SCHEDULE constant
• Each rule has required fields: category, retentionDays, storageLayer, rationale
• Response includes _links (self + fullPolicy)
• Sets Cache-Control: no-store header
• Returns 405 for non-GET methods
• At least one rule has retentionDays: null for chain-derived data