Function delete_older_than 

pub async fn delete_older_than(
    conn: &mut PgConnection,
    cutoff: DateTime<Utc>,
    limit: i64,
) -> ModelResult<u64>

Hard-deletes rows past the retention window: the stored bodies must stop existing.

Bounded, because the first sweep after the window opens has ninety days of traffic to clear and one unbounded statement would hold every credit_registration_events row referencing them locked while ON DELETE SET NULL fires. Returns how many were deleted, so the caller can tell a finished sweep from one that hit the bound.