feat(homeassistant): an admin signs in to Home Assistant, with nothing added to it (#6355)

Replaces the read-only token and the webhook automation, which every install
would have had to paste into its own Home Assistant. Connect now goes to Home
Assistant's own sign-in page, and Steward keeps the refresh token that comes
back, encrypted, and calls backup.create_automatic and update.install directly.

The connection page warns that the stored credential has the same access as
the user who signed in, and recommends a service account so Steward's actions
are easy to tell apart in Home Assistant's logs. A user who isn't an
administrator gets the status page and no Install.

Those actions answer only when finished, so a request cut off once sent counts
as sent and the outcome is read from the entities. Removing the connection, or
signing in again, ends the old sign-in on Home Assistant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -214,7 +214,7 @@ ACTIONS = {
     "prometheus.template_created": "added Prometheus widget template",
     "prometheus.template_updated": "changed Prometheus widget template",
     "prometheus.template_deleted": "deleted Prometheus widget template",
-    "homeassistant.connection_saved": "saved the Home Assistant connection",
+    "homeassistant.connection_saved": "signed Steward in to Home Assistant",
     "homeassistant.connection_removed": "removed the Home Assistant connection",
     "homeassistant.update_started": "started a Home Assistant update",
     "syslog.source_added": "added syslog source",

steward/backup/contents.py

@@ -94,7 +94,7 @@ ACTIVITY: dict[str, frozenset[str]] = {
     "prometheus_targets": frozenset({"last_scraped_at", "last_ok_at", "last_error", "last_kept",
                                      "last_dropped", "last_capped"}),
     "homeassistant_connection": frozenset({"refused", "last_polled_at", "last_ok_at", "last_error",
-                                           "updates", "backup", "automation"}),
+                                           "updates", "backup"}),
     # What the sender last sent; its address, name, state and host are setup.
     "syslog_sources": frozenset({"hostname_seen", "first_seen_at", "last_seen_at", "lines_total",
                                  "last_severity", "last_line"}),