feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817)

#5816 "Restoring mode": while a backup goes back in, the scheduler holds,
ingest and HTMX answer 503 with Retry-After (agents keep their samples),
and every page says what is happening. A safety backup of Steward as it
stands is made first, to /data/backups and the bucket. The backup's key
is put in place, the restore audited, and Steward exits with code 3 so
Swarm, compose or systemd starts it fresh. A failed in-place restore
changes nothing and says why on Backups; a full replace that fails after
the wipe restarts into first-run setup.

#5817 "Settings → Backups: Restore": a Restore button on each sent backup
and on the file card. The chosen backup is checked (the same comparison
as Check, now a shared partial) and held server-side for an hour under a
token; it starts only once the admin types "restore", and an older
backup also needs "Replace everything" ticked. A newer backup, or one
whose key can't open its secrets, gets no button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/errors/restoring.html

@@ -0,0 +1,18 @@
+{# errors/restoring.html — every page while a backup is being restored (#5816):
+   what is going back in, by whom, the step it is on. It reloads itself, so
+   the sign-in page appears once Steward is back. #}
+{% extends "base.html" %}
+{% block title %}Restoring a backup — Steward{% endblock %}
+{% block head %}<meta http-equiv="refresh" content="5">{% endblock %}
+{% block content %}
+<div style="text-align:center; padding: 4rem 2rem;">
+  <h1 class="tone-warn" style="font-size: 1.6rem; margin-bottom: 0.75rem;">Steward is restoring a backup</h1>
+  <p style="margin-bottom: 0.5rem;">{{ state.name }}{% if state.by %}, started by {{ state.by }}{% endif %}
+    {%- if state.since %} {{ state.since|ago }}{% endif %}.</p>
+  <p class="tone-dim" style="margin-bottom: 1rem;">{{ state.step }}…</p>
+  <p class="field-hint" style="max-width: 34rem; margin: 0 auto;">
+    Nothing else reads or writes Steward's records until it is done. Agents keep their readings
+    and send them when Steward is back. This page reloads by itself.
+  </p>
+</div>
+{% endblock %}