feat(backups): tell an empty ledger apart from an empty bucket

On the release that adds the ledger the table is empty, so on a host that has
been uploading nightly for months every account read Never, under a sentence
saying no copy had ever reached the bucket. That sentence is untrue on exactly
the morning an operator opens the new card for the first time, and it is a
claim the host cannot make: what is empty is the record, not the bucket.

The run now records every account it walks, not only the ones an object came
of. A walk that produced nothing moves the attempt instant and leaves the
success columns alone, so the two cases separate: no row at all is no record
yet, a row without a success is never. Never now means what the word says —
a run looked at this account and has never put anything there.

The card names the last check on the never row, so the state is a fact with a
timestamp rather than an assertion. Runbook and all seven bundles carry the
same two sentences. The integration file proves both arms against real
Postgres, including that a failed run leaves the previous good copy on the
row.

src/types/backups.ts

@@ -29,6 +29,12 @@ export interface BackupRow {
 export interface OffhostAccountRow {
   userId: string;
   username: string;
+  /**
+   * ISO instant a run last walked this account, or null when none has. Null
+   * is what the whole cohort reads until the first run after the upgrade that
+   * adds the ledger, and the card says so rather than claiming `never`.
+   */
+  lastAttemptAt: string | null;
   /** ISO instant the newest object landed, or null when there is none. */
   lastSuccessAt: string | null;
   /** Size of that object in bytes, or null when there is none. */