docs: Verify and document append-only event guarantees

This commit addresses issue #60 by documenting and enforcing the immutability
guarantees of the event store:

- Document that EventStore interface is append-only by design (no Update/Delete methods)
- Document the immutable nature of events once persisted as an audit trail
- Add JetStream stream retention policy configuration documentation
- Add comprehensive immutability test (TestEventImmutability_InMemory, TestEventImmutability_Sequential)
- Enhance InMemoryEventStore to deep-copy events, preventing accidental mutations
- Update README with detailed immutability guarantees and audit trail benefits

The EventStore interface intentionally provides no methods to modify or delete
events. Once persisted, events are immutable facts that serve as a tamper-proof
audit trail. This design ensures compliance, debugging, and historical analysis.

Acceptance criteria met:
- EventStore interface documented as append-only (event.go)
- JetStream retention policy configuration documented (store/jetstream.go)
- Test verifying events cannot be modified after persistence (store/immutability_test.go)
- README documents immutability guarantees (README.md)

Closes #60

Co-Authored-By: Claude Code <noreply@anthropic.com>

store/jetstream.go

@@ -18,6 +18,38 @@ const (
 )
 
 // JetStreamConfig holds configuration options for JetStreamEventStore
+//
+// # Stream Retention Policy
+//
+// JetStreamEventStore uses a LimitsPolicy retention strategy, which means events are
+// kept for a specified maximum age (StreamRetention). Once events exceed this age,
+// they are automatically purged from the stream.
+//
+// Default retention is 1 year (365 days). This provides:
+// - Long-term audit trail for domain events
+// - Complete history for event replay and analysis
+// - Automatic cleanup of old events to manage storage costs
+//
+// The retention policy is applied when creating the JetStream stream:
+//
+//   stream := &nats.StreamConfig{
+//       ...
+//       Retention: nats.LimitsPolicy,
+//       MaxAge:    config.StreamRetention,
+//       ...
+//   }
+//
+// To configure custom retention, pass a JetStreamConfig with your desired StreamRetention:
+//
+//   config := store.JetStreamConfig{
+//       StreamRetention: 90 * 24 * time.Hour,  // Keep events for 90 days
+//       ReplicaCount:    3,                     // 3 replicas for HA
+//   }
+//   eventStore, err := store.NewJetStreamEventStoreWithConfig(natsConn, "events", config)
+//
+// Note: The retention policy only affects automatic cleanup. Aether does not provide
+// methods to manually delete events - events are immutable once stored and can only
+// be removed by the stream's retention policy or explicit JetStream administration.
 type JetStreamConfig struct {
 	// StreamRetention is how long to keep events (default: 1 year)
 	StreamRetention time.Duration