feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/backups.html

@@ -30,8 +30,9 @@
   <div class="card" style="margin-bottom:1.25rem;">
     <h2 class="section-title" style="margin-bottom:0.5rem;">Bucket</h2>
     <p class="field-hint" style="margin-bottom:1rem;">
-      Each backup is one file, <code>steward-&lt;time&gt;.tar</code>: Steward's configuration, its audit log
-      and alert history, and its secret key. Metrics and check results are left out. Anyone holding a
+      Each backup is one file, <code>steward-&lt;time&gt;.tar</code>, for getting Steward running again:
+      its settings, users, hosts, monitors, alert rules and dashboards, and its secret key. Logs and
+      history are left out: the audit log, alert history, metrics and check results. Anyone holding a
       copy can read every password and key Steward keeps, so keep the bucket private.
     </p>