Delete expired app-lock rows (cron)

Expected schedule: daily.

Unlock windows outlive the JWTs they are keyed to, and a user who stops signing in leaves theirs behind forever. Logins already sweep the caller’s own rows; this covers everyone else. Batched, because an unbounded DELETE on a table every login writes would eventually hold locks against live sign-ins.

Returns 204. Requires X-CRON-API-KEY matching CRON_API_KEY.