feat: add safe orphan blob garbage collection

[zerosnacks]

Describe the feature

Add administrative tooling to safely remove blobs that are no longer referenced by Kival.

This should build on the blob-store integrity audit and work across supported blob backends (#32).

Add:

kivald admin blobs purge

The command should only remove blobs that are not referenced by any attachment row and should protect against deleting blobs associated with concurrent or recently failed uploads.

At minimum, it should support:

• a configurable minimum orphan age;
• a dry-run mode;
• clear reporting of blobs selected for deletion;
• re-checking that a blob is still unreferenced immediately before deletion;
• support for all production blob-store backends.

Referenced blobs must never be deleted.

Additional context

This should reuse the same orphan-detection and storage-enumeration logic as kivald admin blobs audit.

Repairing missing or corrupt referenced blobs is out of scope.