feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817)

#5816 "Restoring mode": while a backup goes back in, the scheduler holds,
ingest and HTMX answer 503 with Retry-After (agents keep their samples),
and every page says what is happening. A safety backup of Steward as it
stands is made first, to /data/backups and the bucket. The backup's key
is put in place, the restore audited, and Steward exits with code 3 so
Swarm, compose or systemd starts it fresh. A failed in-place restore
changes nothing and says why on Backups; a full replace that fails after
the wipe restarts into first-run setup.

#5817 "Settings → Backups: Restore": a Restore button on each sent backup
and on the file card. The chosen backup is checked (the same comparison
as Check, now a shared partial) and held server-side for an hour under a
token; it starts only once the admin types "restore", and an older
backup also needs "Replace everything" ticked. A newer backup, or one
whose key can't open its secrets, gets no button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/app.py

@@ -175,6 +175,10 @@ def create_app(
     app.jinja_env.globals["csrf_field"] = _csrf.csrf_field
     # The sign-in page offers "Forgot your password?" only while mail can send (milestone 497).
     app.jinja_env.globals["reset_by_email"] = lambda: bool(app.config.get("SMTP", {}).get("host"))
+    # While a backup is being restored nothing else reads or writes the
+    # database: a page says so, and agents get a 503 to retry (#5816).
+    from .backup import restoring as _restoring
+    app.before_request(_restoring.gate)
     app.before_request(_csrf.check_request)
     # The session cookie is Secure, and HSTS is sent, only on requests that
     # arrived over HTTPS — directly or as a trusted proxy reports it
@@ -595,5 +599,6 @@ async def _mark_interrupted_runs(app: Quart) -> None:
 
 
 async def _run_scheduler(app: Quart) -> None:
+    from .backup.restoring import is_restoring
     from .core.scheduler import start_scheduler
-    await start_scheduler(app._task_registry)
+    await start_scheduler(app._task_registry, paused=is_restoring)