feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/core/backups.md

@@ -14,18 +14,28 @@ Steward back from it into an empty database.
 | `secret.key` | The key Steward's stored passwords and tokens are sealed with |
 | `manifest.json` | Format, Steward version, migration heads, time, and the tables whose rows were left out |
 
+A backup is for **system recovery**: it holds what you would otherwise have
+to set up again, and no logs or history.
+
 **Kept:**
-- configuration: settings, users, API tokens, hosts, monitors, alert rules, maintenance windows, Ansible inventory and schedules, dashboards, SNMP devices, Prometheus targets, UniFi client names;
-- the audit log;
-- alert history.
+- settings, with the passwords and keys they hold;
+- users and API tokens;
+- hosts and their agent enrolments, so agents don't need enrolling again;
+- monitors, alert rules, maintenance windows and maintenance cadences;
+- Ansible inventory and schedules;
+- dashboards and share links;
+- SNMP devices, Prometheus targets and widget templates, UniFi client names.
 
 **Left out** (the tables come back empty and fill again as Steward runs):
-- metrics and their rollups;
+- the audit log;
+- alert history and alert state. Each rule starts inactive and is watched
+  again within a minute;
+- metric anomalies and their reviews;
+- metrics, their rollups and learned normals;
 - monitor check results;
 - Docker, Traefik and UniFi history;
-- Ansible run records;
-- the email queue;
-- password-reset links.
+- Ansible run records and maintenance job history;
+- the email queue, pending invites and password-reset links.
 
 The list is `steward/backup/contents.py`. A test fails when a new table
 appears in neither list, so whoever adds a table decides.
@@ -105,7 +115,7 @@ everything in the database's public schema first.
 then data, then constraints and indexes. Between the data and the
 constraints, a kept row that points at a left-out row is put right by its
 foreign key's ON DELETE:
-- an alert event's link to an Ansible run is cleared;
+- a SET NULL link is cleared and the row kept;
 - a row whose foreign key would cascade or block is removed.
 
 pg_restore 17 writes each section as a script for psql. It runs against