fix(syslog): word its audit actions, list its tables for backups, mark its page top-level, reach its modules as loaded (#5999)

- Audit: syslog.source_* worded, and a Syslog filter area.
- Backups keep syslog_sources (added, named, ignored; what it last sent
  isn't compared) and leave syslog_lines out, as logs.
- The integration test reaches the plugin as loaded (#5775), so its
  tables aren't defined twice; ruff E741.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_syslog.py

@@ -20,17 +20,25 @@ def app():
     return create_app(testing=False)
 
 
+def _mod(sub):
+    """The loaded plugin's module: importing plugins.syslog.models by path
+    would define its tables a second time (#5775)."""
+    from steward.core.plugin_manager import loaded_plugin_submodule
+    module = loaded_plugin_submodule("syslog", sub)
+    assert module is not None, "the syslog plugin isn't loaded"
+    return module
+
+
 def _received(address, text, at):
-    from plugins.syslog.parse import parse
-    from plugins.syslog.receiver import Received
-    return Received(at, address, parse(f"<11>Oct 19 01:12:03 synnas kernel: {text}"))
+    receiver = _mod("receiver")
+    return receiver.Received(at, address, _mod("parse").parse(f"<11>Oct 19 01:12:03 synnas kernel: {text}"))
 
 
 def test_an_unknown_sender_is_offered_and_an_added_one_kept(app):
     from sqlalchemy import delete, func, select
 
-    from plugins.syslog.models import SyslogLine, SyslogSource
-    from plugins.syslog.receiver import store_lines
+    SyslogLine, SyslogSource = _mod("models").SyslogLine, _mod("models").SyslogSource
+    store_lines = _mod("receiver").store_lines
 
     now = datetime(2026, 10, 19, 3, 0, tzinfo=timezone.utc)
 
@@ -54,7 +62,7 @@ def test_an_unknown_sender_is_offered_and_an_added_one_kept(app):
                 await store_lines(s, [_received("10.9.0.1", "kept", now + timedelta(seconds=2))])
         async with app.db_sessionmaker() as s:
             lines = (await s.execute(select(SyslogLine))).scalars().all()
-            assert [(l.app, l.hostname, l.message, l.severity) for l in lines] == [("kernel", "synnas", "kept", 3)]
+            assert [(ln.app, ln.hostname, ln.message, ln.severity) for ln in lines] == [("kernel", "synnas", "kept", 3)]
             assert (await s.get(SyslogSource, src_id)).lines_total == 3
             async with s.begin():
                 await s.execute(delete(SyslogSource))
@@ -65,8 +73,8 @@ def test_an_unknown_sender_is_offered_and_an_added_one_kept(app):
 def test_the_ring_keeps_each_source_within_its_window_and_cap(app):
     from sqlalchemy import delete, select
 
-    from plugins.syslog.models import SyslogLine, SyslogSource
-    from plugins.syslog.retention import prune_syslog_lines
+    SyslogLine, SyslogSource = _mod("models").SyslogLine, _mod("models").SyslogSource
+    prune_syslog_lines = _mod("retention").prune_syslog_lines
 
     now = datetime(2026, 10, 19, 3, 0, tzinfo=timezone.utc)
     line40 = "x" * 40                    # cap 100 keeps 3 (prefixes 0, 40, 80)