v1.3.0 — the deletion guard now measures what it was supposed to

Two more paths where the engine concluded "never watched" from data it never
had, both data loss:

  - The guard compared collected data against CONNECTED servers, not configured
    ones. generate_server_connections returns the survivors of a connection
    failure, so an unreachable Plex produced "1/1 returned data — complete" and
    everything watched only on Plex became deletable.
  - Partial failures inside a server (a dropped shared user, a library that
    would not open) hid watch history while the scan still counted as complete.

Cleanup thresholds are also validated now. CLEANUP_DELETE_AFTER_DAYS=0 meant
flag and delete in the same scan; MAX_AGE=0 flagged the entire library. Both
were accepted from the settings API while SLEEP_DURATION beside them was
bounds-checked.