fix(syslog): word its audit actions, list its tables for backups, mark its page top-level, reach its modules as loaded (#5999)

- Audit: syslog.source_* worded, and a Syslog filter area.
- Backups keep syslog_sources (added, named, ignored; what it last sent
  isn't compared) and leave syslog_lines out, as logs.
- The integration test reaches the plugin as loaded (#5775), so its
  tables aren't defined twice; ruff E741.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -198,6 +198,11 @@ ACTIONS = {
     "prometheus.template_created": "added Prometheus widget template",
     "prometheus.template_updated": "changed Prometheus widget template",
     "prometheus.template_deleted": "deleted Prometheus widget template",
+    "syslog.source_added": "added syslog source",
+    "syslog.source_updated": "changed syslog source",
+    "syslog.source_removed": "removed syslog source",
+    "syslog.source_ignored": "ignored syslog sender",
+    "syslog.source_offered": "offered again syslog sender",
     "backup.made": "sent a backup",
     "backup.failed": "tried to send a backup, which failed:",
     "backup.restored": "restored Steward from a backup",
@@ -210,7 +215,7 @@ AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("user.", "Users"), ("
          ("ansible.run", "Playbook runs"), ("ansible.", "Ansible (all)"),
          ("settings.", "Settings"), ("plugin.", "Plugins"), ("api_token.", "AI access"),
          ("docker.", "Docker"), ("snmp.", "SNMP"), ("prometheus.", "Prometheus"),
-         ("backup.", "Backups"))
+         ("syslog.", "Syslog"), ("backup.", "Backups"))
 
 
 def action_text(action: str) -> str:

steward/backup/contents.py

@@ -26,6 +26,8 @@ KEPT: frozenset[str] = frozenset({
     "snmp_devices", "prometheus_targets", "prometheus_widget_templates",
     # Names given to network clients by hand (UniFi's alias column).
     "unifi_known_clients",
+    # Syslog senders: which were added, under what name, and which ignored.
+    "syslog_sources",
 })
 
 # Rows that are measurements, logs, history or in-flight work: left out.
@@ -58,6 +60,7 @@ EXCLUDED: frozenset[str] = frozenset({
     "unifi_alarms", "unifi_client_snapshots", "unifi_devices", "unifi_dpi_snapshots",
     "unifi_events", "unifi_fw_rules", "unifi_networks", "unifi_port_forwards",
     "unifi_speedtest_results", "unifi_wan_stats", "unifi_wlan_stats",
+    "syslog_lines",
 })
 
 # ── What a check compares (#5823) ────────────────────────────────────────────
@@ -82,6 +85,9 @@ ACTIVITY: dict[str, frozenset[str]] = {
     "snmp_devices": frozenset({"last_polled_at", "last_ok_at", "last_error", "missing"}),
     "prometheus_targets": frozenset({"last_scraped_at", "last_ok_at", "last_error", "last_kept",
                                      "last_dropped", "last_capped"}),
+    # What the sender last sent; its address, name, state and host are setup.
+    "syslog_sources": frozenset({"hostname_seen", "first_seen_at", "last_seen_at", "lines_total",
+                                 "last_severity", "last_line"}),
     # Scraped from the controller; the name and note are what someone set.
     "unifi_known_clients": frozenset({"hostname", "ip", "mac_vendor", "is_blocked", "first_seen",
                                       "last_seen", "scraped_at"}),
@@ -109,5 +115,5 @@ AREAS: tuple[tuple[str, tuple[str, ...]], ...] = (
     ("Ansible", ("ansible_targets", "ansible_groups", "ansible_target_groups", "ansible_schedules")),
     ("Dashboards", ("dashboards", "dashboard_widgets", "dashboard_share_tokens")),
     ("Plugins", ("snmp_devices", "prometheus_targets", "prometheus_widget_templates",
-                 "unifi_known_clients")),
+                 "unifi_known_clients", "syslog_sources")),
 )