feat(recovery): judge the bucket's rule for database dumps in readiness

Only the backups page said when the bucket's lifecycle rules left
database/ out, so every dump, and every deleted account inside it, stayed
in the bucket forever without anyone being told. Readiness gains a
dump_retention signal that reads the same cached lifecycle probe: attention
when dumps go off-host and no rule covers database/, ok with the expiry
when one does, quiet when the bucket will not say, inactive without a
bucket or without off-host dumps. The hourly evaluation pushes it to the
admins like every other signal.

src/components/admin/recovery-readiness-card.tsx

@@ -3,7 +3,8 @@
 /**
  * `<RecoveryReadinessCard>` — every backup signal on one card: the database
  * dump, the weekly account copies, the off-host copies, the last restore
- * drill, the off-host setup and the recovery kit. Each row says its verdict,
+ * drill, the off-host setup, the bucket's rule for the dumps and the recovery
+ * kit. Each row says its verdict,
  * the time it is about and where to fix it.
  *
  * No time window anywhere: a failed drill stays on this card until a later