Add integrity checks and retention to append-only ledgers

[JSONbored]

Problem: doctor's only SQLite health check is a bare SELECT 1 against a single one of the miner's many local stores. The append-only event, governor, and prediction ledgers have no retention/rotation/VACUUM policy and grow forever on a long-running self-hosted instance.

Area: AMS / Self-host

Proposal: Add a real PRAGMA integrity_check sweep across all local stores to doctor, and a configurable retention/rotation policy for the unbounded append-only ledgers.

Deliverables:

• doctor reports integrity status for every store, not just one.
• A retention policy (age- or size-based) for the append-only ledgers, off by default, opt-in via config.

Acceptance criteria:

• doctor flags a corrupted store.
• An operator can enable retention and see old ledger rows actually pruned.

[linear-code]

JSO-3494