feat(epay): auto-delete ePay CF extracts 45 days after issuance

An ePay extract is valid 30 days after issuance; at 45 days it's worthless, so
delete the DB row + its MinIO object to declutter the list and free storage.
Only type='epay' rows are touched — the free cf-intern extracts are kept.

- cleanupExpiredEpayExtracts({olderThanDays=45, dryRun}): COALESCE(documentDate,
  createdAt) < cutoff; deletes MinIO objects (batched, best-effort) then the
  rows. Idempotent.
- Self-contained scheduler (epay-cleanup.ts, same pattern as
  auto-refresh-scheduler): boot run (+90s) then every 24h, started from
  instrumentation.ts. Works with zero external config; idempotent so a
  redeploy/interrupt is harmless.
- GET/POST /api/ancpi/cleanup for manual preview (dry-run) / on-demand run —
  staff session OR cron Bearer (EPAY_CLEANUP_CRON_SECRET /
  NOTIFICATION_CRON_SECRET); excluded from the auth middleware (fail-closed
  in-route). ?days overrides the window.
- deleteCfExtractObjects() helper in epay-storage.

Verified on prod: 0 epay rows currently qualify (all recent); the 8 old intern
rows are correctly left untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/instrumentation.ts

@@ -8,5 +8,9 @@ export async function register() {
     // ParcelSync auto-refresh scheduler DISABLED during GIS DB overhaul.
     // Re-enable by uncommenting the import below once the new schema is stable.
     // await import("@/modules/parcel-sync/services/auto-refresh-scheduler");
+
+    // ePay CF extract auto-cleanup (deletes rows + MinIO objects 45 days
+    // after issuance). Self-contained scheduler; safe to run every deploy.
+    await import("@/modules/parcel-sync/services/epay-cleanup");
   }
 }