feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -228,11 +228,12 @@ jobs:
           fi
 
           # A backup made by the image restores into an empty database, and
-          # Steward starts on it (milestone 507). It carries configuration
-          # (the marker setting) and leaves metrics' rows out.
+          # Steward starts on it (milestone 507). It carries settings (the
+          # marker setting) and leaves metrics and the audit log out.
           sql() { docker exec "$SMOKE-pg" psql -U steward -v ON_ERROR_STOP=1 -tA "$@"; }
           sql -d steward -c "INSERT INTO app_settings (key, value_json, updated_at) VALUES ('smoke.backup', '\"kept\"', now())"
           sql -d steward -c "INSERT INTO plugin_metrics (id, source_module, resource_name, metric_name, value, recorded_at) VALUES ('smoke-metric', 'smoke', 'smoke', 'smoke', 1, now())"
+          sql -d steward -c "INSERT INTO audit_events (id, timestamp, username, action) VALUES ('smoke-audit', now(), 'smoke', 'smoke.backup')"
           docker exec -u app "$SMOKE-app" steward backup --to /tmp/backups
           sql -d steward -c "CREATE DATABASE restored"
           docker exec -u app \
@@ -240,6 +241,7 @@ jobs:
             "$SMOKE-app" sh -c 'steward restore /tmp/backups/steward-*.tar'
           test "$(sql -d restored -c "SELECT value_json FROM app_settings WHERE key = 'smoke.backup'")" = '"kept"'
           test "$(sql -d restored -c "SELECT count(*) FROM plugin_metrics")" = "0"
+          test "$(sql -d restored -c "SELECT count(*) FROM audit_events")" = "0"
           test "$(sql -d restored -c "SELECT count(*) FROM alembic_version")" -ge 1
           docker run -d --name "$SMOKE-restored" --network "$SMOKE-net" \
             -e "STEWARD_DATABASE_URL=postgresql+asyncpg://steward:steward@$SMOKE-pg:5432/restored" \