feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817)

#5816 "Restoring mode": while a backup goes back in, the scheduler holds,
ingest and HTMX answer 503 with Retry-After (agents keep their samples),
and every page says what is happening. A safety backup of Steward as it
stands is made first, to /data/backups and the bucket. The backup's key
is put in place, the restore audited, and Steward exits with code 3 so
Swarm, compose or systemd starts it fresh. A failed in-place restore
changes nothing and says why on Backups; a full replace that fails after
the wipe restarts into first-run setup.

#5817 "Settings → Backups: Restore": a Restore button on each sent backup
and on the file card. The chosen backup is checked (the same comparison
as Check, now a shared partial) and held server-side for an hour under a
token; it starts only once the admin types "restore", and an older
backup also needs "Replace everything" ticked. A newer backup, or one
whose key can't open its secrets, gets no button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/scheduler.py

@@ -60,8 +60,10 @@ class _DueTracker:
         self.in_flight.discard(name)
 
 
-async def start_scheduler(tasks: list[ScheduledTask]) -> None:
-    """Run scheduled tasks in a loop. Call with asyncio.create_task()."""
+async def start_scheduler(tasks: list[ScheduledTask], paused=None) -> None:
+    """Run scheduled tasks in a loop. Call with asyncio.create_task().
+    `paused`, when given, is asked each tick: while it says so nothing new
+    starts (a restore is under way, steward/backup/restoring.py)."""
     tracker = _DueTracker()
 
     def _spawn(task: ScheduledTask, now: float) -> None:
@@ -77,8 +79,9 @@ async def start_scheduler(tasks: list[ScheduledTask]) -> None:
 
     while True:
         now = asyncio.get_event_loop().time()
-        for task in tracker.due(tasks, now):
-            _spawn(task, now)
+        if paused is None or not paused():
+            for task in tracker.due(tasks, now):
+                _spawn(task, now)
         await asyncio.sleep(1)