[DeckSync] Address tombstone review: remote deletes, revival and purge clock

- Treat a record whose server row is gone as a remote delete only when the
  local file still matches the sidecar's base hash. An edit made after the
  remote delete is newer than the delete, so it uploads and revives the row
  instead of being removed.
- Revive a tombstone with the same user and guid in cmdDeckUpload instead of
  inserting a second row next to it, so the deck keeps its id and version
  history and the promise in servatrice.ini.example holds.
- Run tombstone purging on its own clock, driven by the new
  [deck_sync] purge_interval option, so disabling share cleanup no longer
  disables purging silently.
- Write the base snapshot through QSaveFile and log a failed commit, so a
  crash or a full disk cannot leave a truncated base for DeckDiff::merge().

servatrice/servatrice.ini.example

@@ -600,8 +600,14 @@ max_shares_per_day=50
 max_versions=20
 
 ; How many days a deleted deck stays restorable as a tombstone before the
-; cleanup clock purges it (with its versions) for good. Re-uploading the
-; same deck within this window resurrects it instead of creating a copy.
-; A value of 0 purges tombstones on the next cleanup run.
+; purge clock removes it (with its versions) for good. Re-uploading the
+; same deck within this window revives the tombstone instead of creating a copy.
+; A value of 0 purges tombstones on the next purge run.
 ; Default: 30
 tombstone_days=30
+
+; How often, in minutes, the tombstone purge runs. This is independent of
+; [deck_share] cleanup_interval, so disabling share cleanup does not disable
+; purging. A value of 0 disables purging entirely.
+; Default: 60
+purge_interval=60