The setup wizards write no retention block by default, so purge --check-policy then checks nothing #1052

Summary

Neither configuration wizard writes a retention: block unless the operator acts. The in-browser wizard writes it only when a horizon or enforce differs from its default; the CLI wizard writes it only when the operator answers "yes" to "Customise retention horizons?", whose default answer is "no". forgelm purge --check-policy treats a config with no retention: block as "nothing to check", so an operator who accepts the defaults ends up with a config that reports nothing, while the wizard presents the horizons as a configured section.

Evidence

• The in-browser wizard (site/js/wizard.js, the nonDefaultRetention branch) writes the block only when at least one of the four horizons or enforce differs from 1825 / 7 / 90 / 90 / log_only.
• The CLI wizard (forgelm/wizard/_collectors.py::_collect_retention) asks "Customise retention horizons ...?" with default No and returns None on No, so no block is written. On "yes" it returns all five values, defaults included, and the block is written. The prompt does not say what declining means.
• forgelm purge --check-policy --config <that file> prints that no retention: block was loaded and reports no violations (success: true, exit 0). With retention: {} the same command checks the defaults.

Why it matters

The horizons are only ever reported, never enforced, so this is not a data-loss risk. But the wizard presents "Retention horizons (GDPR Art. 5(1)(e))" as a configured section, and an operator reading a clean --check-policy report would take it as "checked and fine" when nothing was checked. The site wizard's retention hint now says that the block is written only for non-default values (pull request #1050), which documents the behaviour but does not fix it.

Acceptance criteria

• Site wizard: when the operator chooses to include retention horizons, the block is written even if every value equals its default; when they do not, nothing is written (unchanged). The accordion's open/closed state is a display toggle, so prefer an explicit control (for example a checkbox) over "the section was opened".
• CLI wizard: the prompt says what declining means ("without a retention block forgelm purge --check-policy checks nothing"). Answering "yes" already writes the block with default values; keep that behaviour and cover it with a test.
• Wizard tests cover both outcomes in both wizards; tools/check_wizard_defaults_sync.py stays green.
• The site wizard hint no longer needs the "written only when a value differs" sentence: remove it from wizard.retention.hint in all six site locales in the same change.

Context

Found while reviewing the retention documentation for #101. Related: #98 (the wizard presents retention.enforce as active enforcement), #92.