fix: turn off housekeeping dry run so the nightly sweep deletes

[FrkAk]

Summary

Sets HOUSEKEEPING_DRY_RUN to "false" for the production and dev Workers, so the nightly cron (0 3 * * *) actually deletes what public.purge_expired_rows selects instead of only counting it.

The sweep only removes expired or revoked auth rows: OAuth access and refresh tokens and client assertions past a 24h grace, sessions and verifications expired for more than 7 days, and team invite codes revoked for more than 30 days. It caps at 5,000 rows per table per run, and leftovers roll to the next night.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)
• Workers smoke passes (bun run build:cf && bun run smoke:cf) — required when this PR touches app/api/**, middleware.ts, worker-cf.ts, or a .node.ts / .workers.ts pair

Config only. A read-only count against production with the same predicates confirmed the first live run only touches expired or revoked auth rows. Each run logs a db_housekeeping event with per-table counts and dryRun:false.

Notes for reviewer

Takes effect on the next deploy of each environment.

Docs impact

• none

Compliance impact

• none; it deletes expired credentials sooner, with no change to personal data collected.