feature: воркер удаляет профили, не использованные PROFILE_TTL_DAYS дней (#20)

Отметка последнего использования — mtime файла в профиле, ставится при открытии и
закрытии окна. Очистка при старте воркера и раз в час; профили с открытым окном
(на этом воркере или по ключу сессии в Redis) не трогаются.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -13,7 +13,6 @@ Not implemented yet, though planned for v1:
 
 - API-key auth (`X-API-Key` is accepted but **not checked**) — [#4](https://redmine.sokolab.xyz/issues/4)
 - persisting request outcomes (success rate) — [#17](https://redmine.sokolab.xyz/issues/17)
-- cleanup of old browser profiles — [#20](https://redmine.sokolab.xyz/issues/20)
 
 ## Architecture
 
@@ -41,7 +40,7 @@ Client → Caddy (TLS) → api (FastAPI) ──task──▶ RabbitMQ ──▶
   reCAPTCHA, hCaptcha) are solved via the client's 2captcha key.
 - **Proxies**: not managed by the service — the client may supply their own proxy per request. Browser locale and
   timezone are derived from the proxy's exit IP.
-- **Sessions**: `session_id` cookie → persistent Chrome profile on disk. A fingerprint (screen, DPR) is generated on
+- **Sessions**: `session_id` cookie → persistent Chrome profile on disk, removed after `PROFILE_TTL_DAYS` (7) unused days. A fingerprint (screen, DPR) is generated on
   the first request of a session; cookies passed in a request replace the profile's cookies.
 - **Browser identity is not configurable**: user agent and window size are the real browser's own — a spoofed UA
   mismatches `userAgentData` and Cloudflare blocks it. Clients take `user_agent` from the response.