feat(homeassistant): waiting updates, backup age, and updates installed after a confirmed backup (#6355)

A new plugin reads Home Assistant with a read-only token every 5 minutes and
shows which Core, OS and add-on updates are waiting and how old the last backup
is. Install takes a backup through a local-only webhook, confirms Home
Assistant's last-backup time moved, installs, and follows the update to its end,
through Home Assistant's and Steward's own restarts. One runs at a time. Each
ends as one timeline entry.

Steward holds nothing that can act on the house: the webhook's automation can
only take a backup or install an allowed update (System 231's ruling). A refused
token stops polling, as Home Assistant bans an address after a few refusals.

Milestone 576 steps 1 to 5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/timeline/catalog.py

@@ -118,7 +118,7 @@ for _t in (
 # A source not listed here is Monitoring.
 _SOURCE_AREAS = {
     "icmp": "network", "dns": "network", "tcp": "service", "http": "service",
-    "docker": "service", "prometheus": "service",
+    "docker": "service", "prometheus": "service", "homeassistant": "service",
     "traefik": "network", "unifi": "network",
     "snmp": "hardware",
 }
@@ -154,6 +154,8 @@ _AUDIT_TYPES = (
     ("account.time_zone", None), ("account.email", None),
     ("host_agent.maintenance_plan", "steward.config"), ("host_agent.maintenance", None),
     ("docker.prune.", None),
+    # An update is on the timeline as itself, once it ends (homeassistant.timeline).
+    ("homeassistant.update", None),
     # A change recorded by hand is on the timeline as itself (timeline.changes).
     ("timeline.change", None),
     # A ticket's opening, resolution and reopening are on the timeline as