feat(backup): check a backup against what is in place, changing nothing (#5823)

#5823 "Check a backup: compare what it would restore with what is in
place, without restoring".

- steward/backup/check.py: pg_restore writes the backup's rows as COPY
  text with no database involved. The rows in place go out through COPY in
  the same form. Tables are compared on their primary keys, over the columns
  both sides have, and grouped by area.
- Sealed values are opened with each side's own key and compared as
  plaintext digests, so a secret sealed twice still matches. They are never
  shown. A backup whose key can't open its own secrets fails the check.
- What Steward records as it runs (last-seen times, a schedule's last run,
  backup history, scraped UniFi fields) is left out of the comparison:
  contents.ACTIVITY, STATE_SETTINGS and HAND_SET_ONLY.
- Settings → Backups:
  - a Check button on each sent backup, which fetches it from the bucket
    (new s3.get_file);
  - "Check a file" to upload one, with the size limit raised before the
    CSRF check reads the form;
  - a results page.
- Each backup Steward sends checks itself once written, and its history
  row says how that went.
- New CLI command `steward check-backup FILE`. CI's image smoke step checks a
  real backup against its source and expects a match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/settings/routes.py

@@ -776,6 +776,54 @@ async def backup_now():
     return await _backups_page({"ok": started, "message": message})
 
 
+async def _check_page(report=None, error: str = "", name: str = ""):
+    return await render_template("settings/backup_check.html", report=report, error=error,
+                                 name=name)
+
+
+@settings_bp.post("/backups/check/")
+@require_role(UserRole.admin)
+async def check_stored_backup():
+    """Check one of the backups on the bucket against what is in place
+    (#5823). Read-only: nothing here changes."""
+    from steward.backup import job
+    from steward.backup.dump import BackupError
+    from steward.backup.s3 import S3Error
+    name = (await request.form).get("name", "")
+    try:
+        report = await job.check_stored(current_app._get_current_object(), name)
+    except (BackupError, S3Error) as exc:
+        error = str(exc)
+        if "AccessDenied" in error:
+            error += (" The bucket's key may not read backups back; download the file from the "
+                      "bucket and check it with Check a file instead.")
+        return await _check_page(error=error, name=name)
+    return await _check_page(report=report, name=name)
+
+
+@settings_bp.post("/backups/check/file/")
+@require_role(UserRole.admin)
+async def check_uploaded_backup():
+    """Check a backup file sent from the browser. Its size limit is raised
+    before the form is read (auth/csrf.py UPLOAD_LIMITS)."""
+    import tempfile
+
+    from steward.backup import job
+    from steward.backup.dump import BackupError
+    upload = (await request.files).get("file")
+    if upload is None or not upload.filename:
+        return await _check_page(error="Choose a backup file to check.")
+    name = Path(upload.filename).name
+    with tempfile.TemporaryDirectory(prefix="steward-check-") as tmp:
+        path = Path(tmp) / "upload.tar"
+        await upload.save(path)
+        try:
+            report = await job.check_file(current_app._get_current_object(), path, name)
+        except BackupError as exc:
+            return await _check_page(error=str(exc), name=name)
+    return await _check_page(report=report, name=name)
+
+
 def _build_plugin_cfg_from_form(plugin: dict, form) -> dict:
     """Extract config values for one plugin from a form submission."""
     name = plugin["_dir"]