feat(backup): daily backups to an S3 bucket, Settings → Backups, and the guide (#5673, #5675)

#5673 "S3 client and the backup job: settings, schedule, history, metrics":
- steward/backup/s3.py: SigV4 over httpx, path-style; put and list only
  (an append-only key is enough; retention is the bucket's). Signing is held
  to AWS's published examples.
- steward/backup/job.py: a 15-minute tick. The daily backup goes at the hour
  chosen on the reader's clock; a missed day is made up, and a failure is
  retried an hour later. History of the last 30 runs, audit
  (backup.made / backup.failed), and backup_age_secs / backup_bytes under
  "Steward itself", resource backup, for alert rules.
- Settings → Backups: verdict first, then the bucket (secret sealed; a
  blank box keeps it), the schedule, Test the bucket, Back up now, and the
  recent runs.

#5675 "Docs: backing up to Archives, and restoring": docs/core/backups.md.

Also: the audit page now words the Prometheus target actions from #5668,
which showed as codes, and a guard fails on any logged action without
wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/app.py

@@ -441,12 +441,25 @@ def _register_core_tasks(app: Quart) -> None:
         from .core.self_monitor import record_self_metrics
         await record_self_metrics(app)
 
+    async def run_backup_tick():
+        from .backup.job import tick
+        await tick(app)
+
     async def run_email_outbox():
         from .core.outbox import send_due
         await send_due(app)
 
+    from .backup.job import TICK_SECONDS as BACKUP_TICK_S
     from .core.outbox import SENDER_TICK_S
     app._task_registry.extend([
+        # Steward's own daily backup to its bucket (#5673): a tick that
+        # records the newest backup's age and makes one when it is due.
+        ScheduledTask(
+            name="backup",
+            coro_factory=run_backup_tick,
+            interval_seconds=BACKUP_TICK_S,
+            run_on_startup=False,
+        ),
         # Every email is a row until the mail server accepts it (#5506); this
         # sends what is due and retries what failed. On startup too, so what a
         # restart left unsent goes out at once.