feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/alerts/service.py

@@ -744,6 +744,25 @@ async def reconcile_covering_rules(app) -> None:
                                 ", ".join(added) or "none", ", ".join(removed) or "none")
 
 
+async def ensure_rule_states(app) -> int:
+    """A state row, inactive, for every rule watching one resource that has
+    none. Evaluation skips a rule without one, and a backup leaves alert state
+    out (System 180, 2026-10-15), so a restored rule comes back without it.
+    Run each minute by the core scheduler (alert_reconcile): a restored rule is
+    watched again within a minute. Returns how many rows were added."""
+    async with app.db_sessionmaker() as db:
+        async with db.begin():
+            has_state = select(AlertState.id).where(AlertState.rule_id == AlertRule.id).exists()
+            missing = (await db.execute(select(AlertRule.id).where(
+                AlertRule.covers == "resource", ~has_state))).scalars().all()
+            now = datetime.now(timezone.utc)
+            db.add_all([AlertState(rule_id=rule_id, state=AlertStateEnum.inactive,
+                                   last_transition_at=now) for rule_id in missing])
+    if missing:
+        logger.info("Alert rules without a state row: added %d", len(missing))
+    return len(missing)
+
+
 def part_of(rule: AlertRule, rules) -> AlertRule | None:
     """The covering rule a child belongs to, from a list of rules; None for a
     rule that stands alone."""