feat: burn-after-read and expiry cleaner

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/main.py

@@ -1,11 +1,25 @@
+import asyncio
 from contextlib import asynccontextmanager
 
 from fastapi import FastAPI
 
 from app.api.public import router as public_router
 from app.config import settings
-from app.db import Base, engine
+from app.db import Base, SessionLocal, engine
 from app import models  # noqa: F401 — register models with Base.metadata
+from app.services import cleaner as cleaner_service
+
+
+async def _cleaner_loop() -> None:
+    while True:
+        db = SessionLocal()
+        try:
+            cleaner_service.run_once(db)
+        except Exception:
+            pass
+        finally:
+            db.close()
+        await asyncio.sleep(60)
 
 
 @asynccontextmanager
@@ -13,7 +27,15 @@ async def lifespan(_app: FastAPI):
     settings.data_dir.mkdir(parents=True, exist_ok=True)
     settings.uploads_dir.mkdir(parents=True, exist_ok=True)
     Base.metadata.create_all(bind=engine)
-    yield
+    task = asyncio.create_task(_cleaner_loop())
+    try:
+        yield
+    finally:
+        task.cancel()
+        try:
+            await task
+        except asyncio.CancelledError:
+            pass
 
 
 app = FastAPI(title="MincedPad", lifespan=lifespan)