feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/backup/contents.py

@@ -2,38 +2,43 @@
 or left out, and tests/core/test_backup_contents.py fails on one that is
 neither, so a new table is a decision someone makes in this file.
 
-The operator's ruling (System 180 "Backup & Restore", 2026-10-12): a backup
-carries configuration, the audit log and alert history. Metrics, check
-results and the Docker, Traefik and UniFi history are left out: their tables
-come back with their structure and no rows, and fill again as Steward runs.
+The operator's ruling (System 180 "Backup & Restore", 2026-10-15): a backup
+is for system recovery. It carries settings and keys, what would otherwise
+have to be set up again, and no logs or history: not the audit log, not
+alert history, not metrics. Left-out tables come back with their structure
+and no rows, and fill again as Steward runs.
 
 A table that is in neither list (an external plugin's) is backed up whole:
 a table nobody thought about is kept, never lost.
 """
 from __future__ import annotations
 
-# Configuration, and the history the operator chose to keep.
+# What would otherwise have to be set up again.
 KEPT: frozenset[str] = frozenset({
-    "app_settings", "users", "user_invites", "api_tokens",
+    "app_settings", "users", "api_tokens",
     "hosts", "host_agent_registrations",
     # A group's maintenance cadence (#5768): configuration.
     "host_maintenance_plans",
     "monitors",
-    "alert_rules", "alert_states", "maintenance_windows",
+    "alert_rules", "maintenance_windows",
     "ansible_targets", "ansible_groups", "ansible_target_groups", "ansible_schedules",
     "dashboards", "dashboard_widgets", "dashboard_share_tokens",
     "snmp_devices", "prometheus_targets", "prometheus_widget_templates",
     # Names given to network clients by hand (UniFi's alias column).
     "unifi_known_clients",
-    # History kept by the ruling.
-    "audit_events", "alert_events",
-    # Metric anomalies and their reviews (#5740): what someone marked normal
-    # or real is a decision, kept like alert history.
-    "metric_anomalies", "metric_anomaly_spans",
 })
 
-# Rows that are measurements, logs or in-flight work: left out.
+# Rows that are measurements, logs, history or in-flight work: left out.
 EXCLUDED: frozenset[str] = frozenset({
+    # Logs and history (the 2026-10-15 ruling): a recovery doesn't need them.
+    "audit_events", "alert_events",
+    # Live state: each rule starts inactive, and alert_reconcile gives a
+    # restored rule its state row within a minute (ensure_rule_states).
+    "alert_states",
+    # Metric anomalies and their reviews (#5740): history of the metrics.
+    "metric_anomalies", "metric_anomaly_spans",
+    # A pending invite is in flight, not setup; it can be sent again.
+    "user_invites",
     "plugin_metrics", "plugin_metric_latest", "plugin_metrics_hourly",
     # Learned from the metrics above, so relearned once they fill again.
     "metric_norms",