Give OAuth client registrations a fixed inactivity lifetime

From the privacy-policy legal review of 2026-08-03: indefinite retention of OAuth client registrations until LRU displacement at the 10,000-entry cap "remains the clearest data-minimisation weakness."

Current behaviour (src/auth.rs, SharedClients): registrations are pseudonymous personal data persisted to OAUTH_CLIENTS_FILE; a registration is kept until displaced by the LRU once the store is full — for a rarely-used deployment, indefinitely. Every /oauth/authorize already marks its client used, so per-entry recency exists.

Asked for:

1. Delete registrations after a fixed period of inactivity (the review suggests ~12 months) — a reaper sweep over the persisted store, using the recency the LRU already tracks (a timestamp will need to be added to the persisted entry; deserialization must default it for existing stores).
2. Ideally, a deletion mechanism (DCR supports RFC 7592 management, or an operational path).

When it ships: update the retention row in the privacy policy (src/assets/privacy-policy.html + docs/icp-mcp-privacy-policy-draft.md), which currently states the indefinite-until-displaced behaviour honestly, and let the policy make the stronger promise.

Start in src/auth.rs at SharedClients and trace the persisted OAUTH_CLIENTS_FILE store and its existing LRU recency handling. Define how inactivity timestamps, legacy deserialization, sweeping, and client deletion fit together. Update src/assets/privacy-policy.html and docs/icp-mcp-privacy-policy-draft.md so the retention statement matches the shipped behavior.