feat(backup): restore at first-run setup, restore --in-place, docs lead with the UI (#5818, #5819)

#5818 "First-run setup: Restore from a backup, by upload": beside creating
the first admin, setup offers "Or restore from a backup". Only while no
user exists; the upload is checked (a newer backup or one whose key can't
open its secrets is refused and not kept), then restored with no safety
backup (nothing to keep), and Steward restarts into the backup's users.

#5819 "Docs and CI": backups.md leads with restoring from Settings →
Backups and from setup; `steward restore --in-place` does the same-schema
restore from the shell, and CI's image check now uses it with a real
pg_restore: a changed setting comes back and the audit log stays.

Also exempts errors/restoring.html from the breadcrumb guard, as with
the other whole-app error pages: it replaces every page while a restore
runs, so there is nowhere to trail back to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/backup/restoring.py

@@ -70,22 +70,24 @@ def is_restoring() -> bool:
 
 
 def start_restore(app, path: Path, name: str, *, username: str, replace_all: bool = False,
-                  owned_dir: Path | None = None) -> bool:
+                  owned_dir: Path | None = None, safety: bool = True) -> bool:
     """Start restoring `path` in the background; False if a restore is already
-    under way. `owned_dir`, when given, is removed once it is over."""
+    under way. `owned_dir`, when given, is removed once it is over. `safety`
+    False skips the safety backup: first-run setup has nothing to keep."""
     if STATE.active or STATE.restart_requested:
         return False
     STATE.active, STATE.name, STATE.by = True, name, username
     STATE.since, STATE.step, STATE.error = datetime.now(timezone.utc), "Reading the backup", ""
     task = asyncio.get_running_loop().create_task(
-        _run(app, path, name, username=username, replace_all=replace_all, owned_dir=owned_dir))
+        _run(app, path, name, username=username, replace_all=replace_all, owned_dir=owned_dir,
+             safety=safety))
     _tasks.add(task)
     task.add_done_callback(_tasks.discard)
     return True
 
 
 async def _run(app, path: Path, name: str, *, username: str, replace_all: bool,
-               owned_dir: Path | None) -> None:
+               owned_dir: Path | None, safety: bool = True) -> None:
     from steward.core.audit import log_audit
 
     from .dump import BackupError
@@ -97,8 +99,10 @@ async def _run(app, path: Path, name: str, *, username: str, replace_all: bool,
         if pinned and pinned != key:
             raise BackupError("STEWARD_SECRET_KEY is set and differs from the backup's key; "
                               "set it to the backup's key first, or its passwords and keys can't be read.")
-        STATE.step = "Saving a safety backup of Steward as it stands"
-        safety = await _safety_backup(app)
+        safety_name = ""
+        if safety:
+            STATE.step = "Saving a safety backup of Steward as it stands"
+            safety_name = await _safety_backup(app)
         STATE.step = "Restoring"
         plugin_dirs = [Path(d) for d in app.config["PLUGIN_DIRS"]]
         if replace_all:
@@ -114,7 +118,7 @@ async def _run(app, path: Path, name: str, *, username: str, replace_all: bool,
         if done.secret_key != app.config["SECRET_KEY"] and not pinned:
             _write_key(done.secret_key)
         await log_audit(app, None, username, "backup.restored", entity_type="backup",
-                        entity_id=name, detail=detail | {"safety_backup": safety})
+                        entity_id=name, detail=detail | ({"safety_backup": safety_name} if safety else {}))
         logger.warning("Restored %s (%s); restarting", name, detail["mode"])
         STATE.step = "Restored. Steward is restarting; sign in again when it is back"
         _restart_soon()