fix(backup): the safety backup's audit row names who restored (#5820)

On the live restore the "before restore" backup.made row read user
"unknown": _safety_backup recorded it with no username. It now carries
the person who started the restore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/backup/restoring.py

@@ -102,7 +102,7 @@ async def _run(app, path: Path, name: str, *, username: str, replace_all: bool,
         safety_name = ""
         if safety:
             STATE.step = "Saving a safety backup of Steward as it stands"
-            safety_name = await _safety_backup(app)
+            safety_name = await _safety_backup(app, username)
         STATE.step = "Restoring"
         plugin_dirs = [Path(d) for d in app.config["PLUGIN_DIRS"]]
         if replace_all:
@@ -162,7 +162,7 @@ def _backup_key(path: Path) -> str:
         raise BackupError(f"{path.name} isn't a Steward backup.") from None
 
 
-async def _safety_backup(app) -> str:
+async def _safety_backup(app, username: str) -> str:
     """A backup of Steward as it stands, before anything is replaced: on
     /data/backups always, and on the bucket when one is set. Its run is in
     Recent backups like any other."""
@@ -182,7 +182,7 @@ async def _safety_backup(app) -> str:
         await put_file(target, made.name, made.path)
     else:
         entry["error"] = "Kept on /data/backups only: no bucket is set up."
-    await _record(app, entry, None, "")
+    await _record(app, entry, None, username)      # the audit row names who restored
     _prune()
     return made.name