fix(persistence): address PR review feedback (4 low-cost improvements)

From PR #114 external review agent — adopted the real, low-cost findings;
remaining items (false positives / design trade-offs) explained in PR replies:

- coerceEpoch: !Number.isNaN → Number.isFinite — reject ±Infinity, which
  previously slipped through and produced Invalid Date via new Date(Infinity)
- enforceRetentionCap pass2/pass3: decrement overflow only when idbDelete
  actually succeeds — a failed best-effort delete no longer under-evicts
- cloudListStories: explicit column list instead of select() — avoid pulling
  the bulky session_jsonb when only metadata is needed
- Supabase stories: composite primary key (user_id, id) + onConflict user_id,id
  — avoid a cross-user Session.id collision rejecting the second user's save
  (skeleton not yet deployed, so the migration is edited in place)

typecheck + build:cf green.

lib/persistence/cloudStore.ts

@@ -122,7 +122,7 @@ export async function cloudSaveStory(
           deleted_at: null,
           session_jsonb: blob.session,
         },
-        { onConflict: "id" },
+        { onConflict: "user_id,id" },
       )
       .select()
       .single();
@@ -163,9 +163,13 @@ export async function cloudListStories(): Promise<StoryMeta[]> {
   if (!userId) return [];
   try {
     const supabase = await createClient();
+    // Explicit column list (not select()) so the list query doesn't pull the
+    // bulky session_jsonb — rowToMeta only needs the denormalized metadata.
     const { data, error } = await supabase
       .from("stories")
-      .select()
+      .select(
+        "id, world_setting, style_guide, orientation, scene_count, created_at, updated_at",
+      )
       .eq("user_id", userId)
       .is("deleted_at", null)
       .order("updated_at", { ascending: false });