feat(p1): GC cron for expired memories (LGPD hard delete) (#17)

- POST /api/cron/gc: automated GC with Bearer CRON_SECRET auth
- ForgeGcAuditLog: append-only audit trail
- Batched hard-delete: 50 rows/query, max 500 rows/run
- LGPD Article 16: erasure, not soft-delete
- Constant-time secret comparison (crypto.timingSafeEqual)
- Fail-closed: 503 on missing env, 401 on wrong auth
- CHANGELOG + SECURITY.md updated

Author: SynapseLayer

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [Unreleased]
+
+### Added
+- **GC Cron for expired memories** (P1, LGPD compliance)
+  - `POST /api/cron/gc` — automated garbage collection endpoint
+  - Bearer token auth via `CRON_SECRET` (constant-time comparison)
+  - Hard-deletes `ForgeMemory` rows where `expiresAt < NOW()`
+  - Batched: 50 rows per DELETE, max 10 iterations (500 rows/run cap)
+  - `ForgeGcAuditLog` table — append-only audit trail (ranAt, deletedCount, durationMs, status)
+  - FK-aware: cascades QualityGateResult cleanup before memory deletion
+  - Fail-closed: missing env → 503, wrong/missing auth → 401, never 200 on auth failure
+
+### Security
+- LGPD Article 16 compliance: expired data is hard-deleted (erasure), not soft-deleted
+- Zero PII in logs (only counts + duration)
+- Parameterized queries only (zero string interpolation)
+- Constant-time secret comparison (`crypto.timingSafeEqual`)
+
+
 ## [2.3.7] - 2026-05-04
 
 ### Changed

SECURITY.md

@@ -23,3 +23,14 @@
 - CI secret scanning on every commit
 - Content sanitization before encryption
 - Encryption: AES-256-GCM at rest with per-operation random IV — content cleared after encryption
+
+## Data Retention
+
+Memories with a TTL (`expiresAt` field) are automatically hard-deleted when expired:
+
+- **Mechanism**: Automated GC cron runs daily, deleting expired rows in batches
+- **Auth**: Bearer token (`CRON_SECRET`) with constant-time comparison
+- **Batching**: Max 50 rows per query, max 10 iterations per run (500 rows cap)
+- **Audit**: Every GC run is logged to `ForgeGcAuditLog` (timestamp, count, duration, status)
+- **LGPD/GDPR**: Hard delete (erasure) — no soft-delete for expired data
+- **Fail-closed**: Auth failure returns 401, never exposes data