feat(backup): a backup holds settings and keys only, for recovery (#5822)

#5822 "Backup contents: settings and keys only". The operator's ruling
(System 180, 2026-10-15) overturns 2026-10-12's "Config + audit + alerts":
a backup is for system recovery and carries what would otherwise have to
be set up again, with no logs or history.

- contents.py: audit_events, alert_events, alert_states, metric_anomalies,
  metric_anomaly_spans and user_invites move to EXCLUDED.
- Alert state is no longer restored, and evaluation skips a rule with no
  state row. ensure_rule_states (alerts/service.py) gives every
  single-resource rule lacking one an inactive row; alert_reconcile runs
  it each minute.
- Docs, the Backups page and the CLI help say what a backup holds now.
  CI's image check also finds the audit log empty after a restore.
- tests/integration/test_backup_restore_fixes.py is removed: its case (an
  alert event naming a left-out Ansible run) no longer arises. The SET NULL
  fix-up is covered by a unit test on synthetic tables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_alert_states.py

@@ -173,3 +173,60 @@ def test_record_metrics_marks_each_step(app):
     watched, unwatched = asyncio.run(_go())
     assert watched == ["flush", "rules", "evaluate"]
     assert unwatched == ["flush", "rules"]   # no rule watches it: nothing to evaluate
+
+
+def test_a_rule_without_state_gets_one_and_is_watched_again(app):
+    """A backup leaves alert state out (System 180, 2026-10-15): a restored
+    rule has none, and evaluation skips it until alert_reconcile adds it."""
+    from sqlalchemy import delete, func, select
+    from steward.alerts import service as alert_svc
+    from steward.core.alerts import record_metric
+    from steward.models.alerts import AlertOperator, AlertRule, AlertState, AlertStateEnum
+    from steward.models.users import User, UserRole
+
+    async def _go():
+        tag = uuid.uuid4().hex[:8]
+        res = f"restored-{tag}"
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                user = User(username=f"rs-{tag}", email=f"rs-{tag}@test", password_hash="x",
+                            role=UserRole.admin)
+                s.add(user)
+                await s.flush()
+                rule = AlertRule(name=f"restored {tag}", source_module="host_agent",
+                                 resource_name=res, metric_name="cpu_pct",
+                                 operator=AlertOperator.gt, threshold=90.0,
+                                 consecutive_failures_required=1, enabled=True,
+                                 created_by=user.id)
+                cover = AlertRule(name=f"all hosts {tag}", source_module="host_agent",
+                                  resource_name="", metric_name="cpu_pct", covers="all_hosts",
+                                  operator=AlertOperator.gt, threshold=90.0,
+                                  consecutive_failures_required=1, enabled=True,
+                                  created_by=user.id)
+                s.add_all([rule, cover])
+                await s.flush()
+                await s.execute(delete(AlertState).where(AlertState.rule_id == rule.id))
+            ids = (rule.id, cover.id)
+
+        async def states(rule_id):
+            async with app.db_sessionmaker() as s:
+                return (await s.execute(select(func.count()).select_from(AlertState).where(
+                    AlertState.rule_id == rule_id))).scalar_one()
+
+        added = await alert_svc.ensure_rule_states(app)
+        first = (await states(ids[0]), await states(ids[1]))
+        await alert_svc.ensure_rule_states(app)
+        second = await states(ids[0])
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                await record_metric(s, "host_agent", res, "cpu_pct", 99.0)
+        async with app.db_sessionmaker() as s:
+            state = (await s.execute(select(AlertState.state).where(
+                AlertState.rule_id == ids[0]))).scalar_one()
+        return added, first, second, state
+
+    added, first, second, state = asyncio.run(_go())
+    assert added >= 1
+    assert first == (1, 0)              # the covering rule has no state of its own
+    assert second == 1                  # a second pass adds nothing
+    assert state == AlertStateEnum.firing