feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817)

#5816 "Restoring mode": while a backup goes back in, the scheduler holds,
ingest and HTMX answer 503 with Retry-After (agents keep their samples),
and every page says what is happening. A safety backup of Steward as it
stands is made first, to /data/backups and the bucket. The backup's key
is put in place, the restore audited, and Steward exits with code 3 so
Swarm, compose or systemd starts it fresh. A failed in-place restore
changes nothing and says why on Backups; a full replace that fails after
the wipe restarts into first-run setup.

#5817 "Settings → Backups: Restore": a Restore button on each sent backup
and on the file card. The chosen backup is checked (the same comparison
as Check, now a shared partial) and held server-side for an hour under a
token; it starts only once the admin types "restore", and an older
backup also needs "Replace everything" ticked. A newer backup, or one
whose key can't open its secrets, gets no button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -200,6 +200,8 @@ ACTIONS = {
     "prometheus.template_deleted": "deleted Prometheus widget template",
     "backup.made": "sent a backup",
     "backup.failed": "tried to send a backup, which failed:",
+    "backup.restored": "restored Steward from a backup",
+    "backup.restore_failed": "tried to restore Steward from a backup, which failed:",
 }
 
 # The filter's choices: an area, matched as a prefix of the action code.