feat(playout): replace time-based R2 retention with run-count and size caps

docs/STREAMING.md

@@ -180,6 +180,8 @@ A release is streaming-ready only when one full playlist boundary has played wit
 | `R2_ENDPOINT`, `R2_REGION`                 | S3-compatible publication endpoint                 |
 | `R2_BUCKET_NAME`                           | Media bucket                                       |
 | `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY` | Write credentials, available only to the publisher |
+| `R2_KEEP_RUNS`                             | Number of run folders to retain (default `2`)      |
+| `R2_MAX_RETENTION_BYTES`                   | Max bytes retained across run folders (10 GiB)     |
 | `MEDIA_DOMAIN`                             | Public R2 custom domain                            |
 | `VITE_PUBLIC_HLS_URL`                      | Public live manifest URL                           |
 

docs/architecture/README.md

@@ -311,7 +311,7 @@ graph TB
 - **Resilience**: Restart counter (>5/60s → activate slate), Prometheus metrics on port 8081
 - **Validation**: ffprobe gate on all ingested files (codec, fps, resolution, keyframe interval); `-validate` mode checks the playlist without running the loop
 - **Seamless looping**: Only resets HLS output when the playlist fingerprint (SHA-256) changes, on crash/slate recovery, or first run; otherwise continues segment numbering via `-start_number`
-- **R2 retention**: `cleanupOldSegments` deletes `hls/r-*/*` objects older than `R2_SEGMENT_RETENTION_HOURS` (default 24h) hourly + at startup
+- **R2 retention**: `cleanupOldRuns` keeps the newest `R2_KEEP_RUNS` run folders (default 2) and caps retained data at `R2_MAX_RETENTION_BYTES` (default 10 GiB), triggered after each run plus an hourly backstop
 - **Shared config**: Reads the runtime `config.json` (`loadSharedHLSConfig`) as an env fallback for HLS segment duration/window
 
 #### Chat Service (`backend/chat/src/main.go`)
@@ -365,7 +365,7 @@ Module-level breakdown per service.
 | **Loop Controller**  | `playlist.go` (playlistFingerprint, hlsNextStartNumber) | Detect playlist changes (SHA-256), continue segment numbering on clean loops                          |
 | **Slate Controller** | `playlist.go` (activateSlate, deactivateSlate)          | Switch output to slate loop on excessive failures                                                     |
 | **R2 Sync**          | `playlist.go` (syncToR2)                                | Upload HLS segments + manifest to R2 bucket                                                           |
-| **R2 Cleanup**       | `playlist.go` (cleanupOldSegments)                      | Delete stale `hls/r-*/*` segments older than the retention window                                     |
+| **R2 Cleanup**       | `playlist.go` (cleanupOldRuns)                          | Keep the last N run folders under the size cap; delete older `hls/r-*/*` objects                      |
 | **Health Endpoint**  | `playlist.go` (healthHandler)                           | `/health` → JSON with mode, segment count, uptime                                                     |
 | **Metrics Exporter** | `playlist.go` (prometheus)                              | Expose restarts_total, mode (live/slate), loops_total, run_duration_seconds, r2_cleanup_objects_total |