feat(admin): name a switched-off dump and a newly listed kit key plainly

A switched-off scheduled dump is attention now, sent once and never
reminded, with how to turn it back on (DB_BACKUP_ENABLED). Dumps are on
by default, so off is a choice that leaves no copy able to rebuild the
host. An install that never wrote a dump and has nowhere to write one
stays quiet.

The out-of-date kit notice says what changed: the kit now also lists a
key the last confirmation did not cover, for example API_TOKEN_HMAC_KEY
on an instance upgraded from the one-key step, and that nothing broke.

The French kit and readiness strings use vous, the form the rest of the
French bundle uses.

src/lib/recovery/__tests__/readiness-model.test.ts

@@ -92,15 +92,35 @@ describe("database dump", () => {
   const evalDump = (d: ReadinessInputs["dump"], watched: Date | null = null) =>
     evaluateDatabaseDump({ now: NOW, dump: d, dumpWatchedSince: watched });
 
-  it("does not apply while no dump is scheduled, or while it is switched off", () => {
+  it("does not apply while no dump is scheduled", () => {
     expect(evalDump(null)).toMatchObject({
       state: "inactive",
       reason: "not_available",
     });
+  });
+
+  it("calls a switched-off dump attention, once, unless it could never write one", () => {
     expect(evalDump(dump({ enabled: false }))).toMatchObject({
-      state: "inactive",
+      state: "attention",
       reason: "disabled",
     });
+    // Never ran, but a bucket could take it: still a choice worth naming.
+    expect(
+      evalDump(
+        dump({
+          enabled: false,
+          lastGoodAt: null,
+          localDirWritable: false,
+          offhostConfigured: true,
+        }),
+      ).state,
+    ).toBe("attention");
+    // Never ran and nowhere to write: switched off what it could not do.
+    expect(
+      evalDump(
+        dump({ enabled: false, lastGoodAt: null, localDirWritable: false }),
+      ),
+    ).toMatchObject({ state: "inactive", reason: "disabled" });
   });
 
   it("fails when its status cannot be read", () => {

src/lib/recovery/readiness-model.ts

@@ -177,8 +177,19 @@ export function evaluateDatabaseDump(
   const id = "database_dump";
   if (dump === null) return signal(id, "inactive", "not_available", null);
   if (dump === "unreadable") return signal(id, "failing", "unreadable", null);
-  if (!dump.enabled) return signal(id, "inactive", "disabled", null);
   const lastGoodAt = dump.lastGood ? new Date(dump.lastGood.at) : null;
+  if (!dump.enabled) {
+    // Dumps are on by default, so off is a choice someone made, and it
+    // leaves no copy that rebuilds the host: worth one notice. An install
+    // that never wrote a dump and has nowhere to write one (no writable
+    // directory, no bucket) switched off what it could not do, which is not
+    // news.
+    const neverUsed = dump.lastGood === null && dump.lastFailure === null;
+    const cannotWrite = !dump.localDirWritable && !dump.offhostConfigured;
+    return neverUsed && cannotWrite
+      ? signal(id, "inactive", "disabled", null)
+      : signal(id, "attention", "disabled", lastGoodAt);
+  }
   const lastFailureAt = dump.lastFailure ? new Date(dump.lastFailure.at) : null;
   const failureReason = dump.lastFailure?.error ?? null;
   // A directory this process cannot write is a valid setup when the dumps go