Add TOML dependency and new config/startup modules

The TOML dependency is added to `Cargo.lock` to support configuration
file parsing.
New modules `config` and `startup` are introduced in
`doctate-client-core`:
- `config`: Handles client configuration loading and saving, including
  defaults for polling intervals and window hours.
- `startup`: Contains routines for initial cleanup tasks, such as
  removing stale markers and orphan audio files based on defined
  retention periods.

doctate-client-core/src/startup.rs

@@ -0,0 +1,150 @@
+//! One-shot client startup routines shared across all native clients.
+//!
+//! Today this is just the data-minimization sweep: ephemeral devices
+//! (desktop, watch, phone) are "sophisticated microphones" — the client
+//! must not hoard patient-sensitive audio or metadata past the
+//! dictation-day horizon.
+//!
+//! Two retention horizons exist:
+//! - **Audio** (sensitive): 24 h by default. Orphan m4a/sidecar files
+//!   that never reached the server get deleted.
+//! - **Markers** (non-sensitive: UUIDs + oneliners): 72 h by default.
+//!   Long enough to span a weekend; short enough that a stolen device
+//!   can't reconstruct a long case history.
+
+use std::path::Path;
+use std::time::{Duration, SystemTime};
+
+use time::OffsetDateTime;
+use tracing::{info, warn};
+
+use crate::case_store::CaseStore;
+use crate::pending_cleanup::cleanup_orphan_audio;
+
+/// Default retention for case-markers on disk. Confirmed-by-server
+/// markers older than this are pruned; unsynced markers are kept
+/// forever (they guard pending uploads).
+pub const DEFAULT_MARKER_RETENTION: Duration = Duration::from_secs(72 * 3600);
+
+/// Default retention for orphan audio files in the pending directory.
+/// Orphan = an `.m4a` without its matching sidecar, or vice versa,
+/// older than this horizon.
+pub const DEFAULT_ORPHAN_AUDIO_RETENTION: Duration = Duration::from_secs(24 * 3600);
+
+/// Run the one-shot startup cleanup. Intended to be called once at app
+/// launch, before the server-sync worker spawns.
+///
+/// Logs each outcome via `tracing`; no error bubbles up because both
+/// sweeps are best-effort (a failing sweep shouldn't prevent the app
+/// from starting).
+pub async fn run_startup_cleanup(
+    store: &CaseStore,
+    pending_dir: &Path,
+    marker_retention: Duration,
+    orphan_audio_retention: Duration,
+) {
+    let marker_cutoff = OffsetDateTime::now_utc()
+        - time::Duration::seconds(marker_retention.as_secs() as i64);
+    match store.cleanup_stale(marker_cutoff).await {
+        Ok(n) if n > 0 => info!(count = n, "startup cleanup: stale markers removed"),
+        Ok(_) => {}
+        Err(e) => warn!(error = %e, "startup cleanup: marker sweep failed"),
+    }
+
+    let audio_cutoff = SystemTime::now() - orphan_audio_retention;
+    let n = cleanup_orphan_audio(pending_dir, audio_cutoff).await;
+    if n > 0 {
+        info!(count = n, "startup cleanup: orphan audio removed");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::upload::{write_sidecar, PendingUpload};
+    use filetime::{set_file_mtime, FileTime};
+    use tempfile::TempDir;
+    use uuid::Uuid;
+
+    /// Integration-style test: seed a stale synced marker + an orphan
+    /// audio file, call the helper with tight retention horizons, watch
+    /// both go away.
+    #[tokio::test]
+    async fn sweeps_both_stale_markers_and_orphan_audio() {
+        let tmp = TempDir::new().unwrap();
+        let cases_dir = tmp.path().join("cases");
+        let pending_dir = tmp.path().join("pending");
+        std::fs::create_dir_all(&pending_dir).unwrap();
+
+        // Seed a stale synced marker by opening the store, creating it,
+        // flipping the synced flag via merge, then reopening to re-scan.
+        {
+            let (store, _rx) = CaseStore::open(cases_dir.clone()).await.unwrap();
+            let old_id = Uuid::new_v4();
+            let then = OffsetDateTime::parse(
+                "2020-01-01T00:00:00Z",
+                &time::format_description::well_known::Rfc3339,
+            )
+            .unwrap();
+            store.create_local(old_id, then).await.unwrap();
+            store.mark_synced(old_id).await.unwrap();
+        }
+
+        // Seed an orphan audio file, pre-dated to be older than 24h.
+        let orphan = pending_dir.join("orphan.m4a");
+        std::fs::write(&orphan, b"dummy").unwrap();
+        let two_days_ago = SystemTime::now() - Duration::from_secs(48 * 3600);
+        set_file_mtime(&orphan, FileTime::from_system_time(two_days_ago)).unwrap();
+
+        // Also seed a fresh, *paired* upload — must survive both sweeps.
+        let fresh_id = Uuid::new_v4();
+        let fresh_stem = format!("{fresh_id}_2026-04-18T10-00-00Z");
+        let fresh_m4a = pending_dir.join(format!("{fresh_stem}.m4a"));
+        let upload = PendingUpload {
+            case_id: fresh_id,
+            recorded_at: "2026-04-18T10:00:00Z".into(),
+            file: fresh_m4a.clone(),
+        };
+        std::fs::write(&fresh_m4a, b"fresh audio").unwrap();
+        write_sidecar(&upload).unwrap();
+
+        // Reopen store to load all on-disk markers.
+        let (store, _rx) = CaseStore::open(cases_dir).await.unwrap();
+
+        run_startup_cleanup(
+            &store,
+            &pending_dir,
+            Duration::from_secs(3600),       // markers older than 1h: nuke
+            Duration::from_secs(3600),       // orphans older than 1h: nuke
+        )
+        .await;
+
+        // Stale marker gone.
+        assert!(
+            store.list().await.is_empty(),
+            "old synced marker must be swept"
+        );
+        // Orphan gone.
+        assert!(!orphan.exists(), "old orphan audio must be swept");
+        // Fresh paired upload survived.
+        assert!(fresh_m4a.exists(), "fresh paired m4a must remain");
+    }
+
+    #[tokio::test]
+    async fn no_op_on_clean_directories() {
+        let tmp = TempDir::new().unwrap();
+        let cases_dir = tmp.path().join("cases");
+        let pending_dir = tmp.path().join("pending");
+        std::fs::create_dir_all(&pending_dir).unwrap();
+        let (store, _rx) = CaseStore::open(cases_dir).await.unwrap();
+
+        // Should simply return without error and without logs at >= warn.
+        run_startup_cleanup(
+            &store,
+            &pending_dir,
+            DEFAULT_MARKER_RETENTION,
+            DEFAULT_ORPHAN_AUDIO_RETENTION,
+        )
+        .await;
+    }
+}