Add publish preview retention policy, normalize refresh/cached contract, and add storage audit and cleanup admin endpoints

backend/app/api/routes/admin.py

@@ -6,6 +6,10 @@ from app.repositories.scheme_versions import get_current_scheme_version
 from app.repositories.schemes import get_scheme_record_by_scheme_id, list_scheme_records
 from app.repositories.uploads import get_upload_record_by_upload_id
 from app.security.auth import require_api_key
+from app.services.artifact_maintenance import (
+    cleanup_publish_preview_storage,
+    inspect_publish_preview_storage,
+)
 from app.services.display_regenerator import regenerate_display_artifact
 from app.services.scheme_validation import build_scheme_validation_report
 
@@ -160,3 +164,18 @@ async def bulk_backfill_display_artifacts(
         "skipped": skipped,
         "failed": failed,
     }
+
+
+@router.get(f"{settings.api_v1_prefix}/admin/artifacts/publish-preview/audit")
+async def audit_publish_preview_storage(
+    role: str = Depends(require_api_key),
+):
+    return await inspect_publish_preview_storage()
+
+
+@router.post(f"{settings.api_v1_prefix}/admin/artifacts/publish-preview/cleanup")
+async def cleanup_publish_preview_artifacts_endpoint(
+    dry_run: bool = Query(default=True),
+    role: str = Depends(require_api_key),
+):
+    return await cleanup_publish_preview_storage(dry_run=dry_run)