fix(recovery): the database dumps count in the keys the backups still need

The recovery kit, "Keys the backups still need" and safeToDropRetiredKeys
read only the stored copies and the off-host account objects. After a
rotation the page called the old key safe to drop while every dump taken
before it, the pre-migration dumps that are the way back from an update
among them, could only be restored with that key: db-restore refuses a dump
whose active key is missing.

A dump now counts for the key its rows were written under, the manifest's
active key: a dump on this server while it is kept (read from the manifests),
an off-host one until the bucket's rule for database/ expires it, or
indefinitely when that rule cannot be read. The nightly run records the key
on its ledger row (migration 0489, database_backup_runs.active_key_id). The
encryption view and the kit list the dumps per key, in every locale, and the
rotation and backup runbooks say so.

src/lib/database-backup/run.ts

@@ -156,6 +156,7 @@ export async function runDatabaseBackup(
   });
 
   let scratch: string | null = null;
+  let activeKeyId: string | null = null;
   try {
     if (!databaseBackupEnabled(env)) {
       report.status = "skipped";
@@ -182,6 +183,7 @@ export async function runDatabaseBackup(
         deadline: options.deadline,
       });
       if (keepLocal) report.local = "written";
+      activeKeyId = dump.manifest.keys.encryption.activeKeyId;
       report.fileName = basename(dump.dumpPath);
       report.dumpBytes = dump.manifest.dump.bytes;
 
@@ -233,6 +235,7 @@ export async function runDatabaseBackup(
       localResult: report.local,
       offhostResult: report.offhost,
       error: report.error,
+      activeKeyId,
     },
   });
   await prisma.databaseBackupRun.deleteMany({