feat: task trash, triage trash and retention settings for every area; admin can forbid keeping things for good

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_auth.go

@@ -404,8 +404,7 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 	stats, _ := s.store.GetDashboardStats(userID)
 	ns := s.store.NotificationSettingsOf(userID)
 	user.NotificationSettings = &ns
-	user.DoneRetentionDays = s.store.DoneRetentionDays(userID)
-	user.VoiceInput = s.store.VoiceInput(userID)
+	s.fillUserPreferences(user)
 	writeJSON(w, http.StatusOK, map[string]interface{}{
 		"user":  user,
 		"stats": stats,
@@ -519,6 +518,8 @@ func (s *Server) handleUpdateUserSettings(w http.ResponseWriter, r *http.Request
 		DoneRetentionDays *int `json:"doneRetentionDays"`
 		// Voice input: "" (Whisper server, the default) or "browser"
 		VoiceInput *string `json:"voiceInput"`
+		// All retention delays at once (storage/retention.go)
+		Retention *domain.Retention `json:"retention"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
@@ -606,6 +607,10 @@ func (s *Server) handleUpdateUserSettings(w http.ResponseWriter, r *http.Request
 		}
 	}
 	if req.DoneRetentionDays != nil {
+		if *req.DoneRetentionDays == 0 && !s.allowNeverRetention() {
+			writeError(w, http.StatusBadRequest, storage.ErrRetentionNever.Error())
+			return
+		}
 		if err := s.store.SetDoneRetentionDays(userID, *req.DoneRetentionDays); err != nil {
 			writeError(w, http.StatusBadRequest, err.Error())
 			return
@@ -617,10 +622,15 @@ func (s *Server) handleUpdateUserSettings(w http.ResponseWriter, r *http.Request
 			return
 		}
 	}
+	if req.Retention != nil {
+		if err := s.store.SetRetention(userID, *req.Retention, s.allowNeverRetention()); err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+	}
 	ns := s.store.NotificationSettingsOf(userID)
 	u.NotificationSettings = &ns
-	u.DoneRetentionDays = s.store.DoneRetentionDays(userID)
-	u.VoiceInput = s.store.VoiceInput(userID)
+	s.fillUserPreferences(u)
 	writeJSON(w, http.StatusOK, u)
 }
 
@@ -756,3 +766,13 @@ func (s *Server) handleGetUsersDirectory(w http.ResponseWriter, r *http.Request)
 	}
 	writeJSON(w, http.StatusOK, users)
 }
+
+// fillUserPreferences adds the settings kept outside the user row's own fields.
+func (s *Server) fillUserPreferences(u *domain.User) {
+	allowNever := s.allowNeverRetention()
+	r := s.store.RetentionOf(u.ID, allowNever)
+	u.Retention = &r
+	u.RetentionNeverAllowed = allowNever
+	u.DoneRetentionDays = r.DoneTasks
+	u.VoiceInput = s.store.VoiceInput(u.ID)
+}