test(backup): run 9076's three failures (#5673, #5674)

- The audit-wording guard now reads both branches of a conditional action
  ("backup.made" if ok else "backup.failed"), and its self-test covers that.
- The Backups save test no longer asserts the session's tz, which sign-in
  state sets, not the test.
- The restore integration test uses the app's own metadata. all_metadata
  without plugin dirs imports the `plugins` package as the tests do; loading
  by path under the loader's names is only for `steward restore`. Loading by
  path in the shared test process had mapped traefik and unifi tables a
  second time for later tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_audit_actions_worded.py

@@ -20,6 +20,8 @@ def logged_actions(source: str) -> set[str]:
         if not (isinstance(call, ast.Call) and getattr(call.func, "id", getattr(call.func, "attr", "")) in _WRITERS):
             continue
         args = list(call.args) + [k.value for k in call.keywords if k.arg == "action"]
+        # Both branches of `"a.made" if ok else "a.failed"` are actions too.
+        args += [b for a in args if isinstance(a, ast.IfExp) for b in (a.body, a.orelse)]
         found |= {a.value for a in args
                   if isinstance(a, ast.Constant) and isinstance(a.value, str) and _CODE.fullmatch(a.value)}
     return found
@@ -34,5 +36,7 @@ def test_every_logged_action_is_worded():
 
 
 def test_the_guard_can_fail():
-    code = 'async def f(app):\n    await log_audit(app, None, "", "widget.exploded", entity_type="widget")\n'
-    assert logged_actions(code) - set(ACTIONS) == {"widget.exploded"}
+    code = ('async def f(app, ok):\n'
+            '    await log_audit(app, None, "", "widget.exploded", entity_type="widget")\n'
+            '    await log_audit(app, None, "", "widget.fixed" if ok else "widget.broke")\n')
+    assert logged_actions(code) - set(ACTIONS) == {"widget.exploded", "widget.fixed", "widget.broke"}