feat(fusion_clock): auto-wipe clock-in/out photos after a retention window

Privacy/space housekeeping for the kiosk verification selfies. A new daily cron
(_cron_fusion_wipe_old_photos) deletes the photo attachments on attendances
whose clock-in is older than fusion_clock.photo_retention_days (default 60).
Only the images are removed — attendance records, worked hours and penalties
are kept. Clearing the attachment-backed binary reclaims filestore space.

- Configurable in Settings → Fusion Clock → NFC Kiosk ("Auto-Wipe Photos After
  (days)"); set 0 to disable.
- Wipes all three photo fields (NFC check-in/out + legacy portal photo),
  batched with per-batch savepoints.
- tests/test_photo_retention.py covers wipe-old / keep-recent / retention=0.

Verified live on entech (19.0.3.11.7) via a rollback-only dry run: a 70-day
shift's photos were wiped (record + 8h hours preserved) while a 5-day shift's
photo was kept; nothing persisted. 0 attendances currently exceed 60 days.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/views/res_config_settings_views.xml

@@ -258,6 +258,10 @@
                                     <label for="fclk_nfc_photo_required" string="Require Photo" class="col-lg-5 o_light_label"/>
                                     <field name="fclk_nfc_photo_required"/>
                                 </div>
+                                <div class="row mt8">
+                                    <label for="fclk_photo_retention_days" string="Auto-Wipe Photos After (days)" class="col-lg-5 o_light_label"/>
+                                    <field name="fclk_photo_retention_days"/>
+                                </div>
                                 <div class="row mt8">
                                     <label for="fclk_nfc_enroll_password" string="Enroll Password" class="col-lg-5 o_light_label"/>
                                     <field name="fclk_nfc_enroll_password" password="True"/>