fix(recovery): the database dumps count in the keys the backups still need

The recovery kit, "Keys the backups still need" and safeToDropRetiredKeys
read only the stored copies and the off-host account objects. After a
rotation the page called the old key safe to drop while every dump taken
before it, the pre-migration dumps that are the way back from an update
among them, could only be restored with that key: db-restore refuses a dump
whose active key is missing.

A dump now counts for the key its rows were written under, the manifest's
active key: a dump on this server while it is kept (read from the manifests),
an off-host one until the bucket's rule for database/ expires it, or
indefinitely when that rule cannot be read. The nightly run records the key
on its ledger row (migration 0489, database_backup_runs.active_key_id). The
encryption view and the kit list the dumps per key, in every locale, and the
rotation and backup runbooks say so.

tests/integration/database-backup.test.ts

@@ -196,6 +196,9 @@ describe("the nightly database dump", () => {
       error: null,
     });
     expect(Number(runs[0].dumpBytes)).toBe(manifest.dump.bytes);
+    // The key a restore of this dump needs, for the recovery kit.
+    expect(runs[0].activeKeyId).toBe(manifest.keys.encryption.activeKeyId);
+    expect(runs[0].activeKeyId).not.toBeNull();
     const health = await getDatabaseBackupHealth(
       new Date("2026-10-20T02:00:00Z"),
       backupEnv(),