Data Retention Policies

Pending – will specify retention durations for audit logs, scan events, archived data, and GDPR erasure flows.