Persistence layer changes, all backward-compatible with existing
databases via in-place column migration:
- WAL journal mode + a 5s busy timeout so overlapping `--capture-once`
writers and the popup reader stop dropping captures on SQLITE_BUSY.
- `HistoryError` replaces bare `rusqlite::Error` so a filesystem failure
while writing an image file surfaces instead of leaving a row that
points at a file that was never written.
- Image files are created 0600 from the first syscall (O_CREAT|O_EXCL,
mode 0600) — no world-readable window before a chmod. Data and images
dirs are forced to 0700 on every open. `gc_orphaned_images` sweeps
image files no row references (older than 1h, to spare in-flight
writes).
- `pinned` and `is_primary` columns. Pinned rows are exempt from trim
and sort first; `list_entries` breaks timestamp ties by `id DESC` so
ordering (and which rows trim keeps) is deterministic within a second.
- `Retention` caps are now a field on `HistoryDb` (`open_with`), and
`0` is a legal value ("keep no unpinned entries of this kind").
New `config` module: optional TOML at
`$XDG_CONFIG_HOME/breadclip/config.toml`, every key defaulted and
clamped, unparseable file backed up once (bread-utils tomlcfg
discipline). Keys: retention.text/images, panel.width, capture.primary.
967fd9f1b7