feat(backup): daily backups to an S3 bucket, Settings → Backups, and the guide (#5673, #5675)

#5673 "S3 client and the backup job: settings, schedule, history, metrics":
- steward/backup/s3.py: SigV4 over httpx, path-style; put and list only
  (an append-only key is enough; retention is the bucket's). Signing is held
  to AWS's published examples.
- steward/backup/job.py: a 15-minute tick. The daily backup goes at the hour
  chosen on the reader's clock; a missed day is made up, and a failure is
  retried an hour later. History of the last 30 runs, audit
  (backup.made / backup.failed), and backup_age_secs / backup_bytes under
  "Steward itself", resource backup, for alert rules.
- Settings → Backups: verdict first, then the bucket (secret sealed; a
  blank box keeps it), the schedule, Test the bucket, Back up now, and the
  recent runs.

#5675 "Docs: backing up to Archives, and restoring": docs/core/backups.md.

Also: the audit page now words the Prometheus target actions from #5668,
which showed as codes, and a guard fails on any logged action without
wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -187,6 +187,11 @@ ACTIONS = {
     "snmp.device_created": "added SNMP device",
     "snmp.device_updated": "changed SNMP device",
     "snmp.device_deleted": "deleted SNMP device",
+    "prometheus.target_created": "added Prometheus target",
+    "prometheus.target_updated": "changed Prometheus target",
+    "prometheus.target_deleted": "deleted Prometheus target",
+    "backup.made": "sent a backup",
+    "backup.failed": "tried to send a backup, which failed:",
 }
 
 # The filter's choices: an area, matched as a prefix of the action code.
@@ -194,7 +199,8 @@ AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("user.", "Users"), ("
          ("alert_rule.", "Alert rules"), ("maintenance_window.", "Maintenance"),
          ("ansible.run", "Playbook runs"), ("ansible.", "Ansible (all)"),
          ("settings.", "Settings"), ("plugin.", "Plugins"), ("api_token.", "AI access"),
-         ("docker.", "Docker"), ("snmp.", "SNMP"))
+         ("docker.", "Docker"), ("snmp.", "SNMP"), ("prometheus.", "Prometheus"),
+         ("backup.", "Backups"))
 
 
 def action_text(action: str) -> str:
@@ -211,7 +217,8 @@ _LABELS = {"check": "dry run", "interval_seconds": "every", "interval_s": "every
 _METHODS = {"local": "password", "ldap": "LDAP", "oidc": "single sign-on"}
 _SECTIONS = {"general": "General", "thresholds": "Thresholds", "notifications": "Notifications",
              "ansible.managed_key": "Ansible: managed SSH key",
-             "ansible.credentials": "Ansible: credentials", "auth": "Authentication"}
+             "ansible.credentials": "Ansible: credentials", "auth": "Authentication",
+             "backups": "Backups"}
 
 
 def _plain(value) -> str: