fix(qa): apply pre-release multi-agent QA findings

Three small follow-ups surfaced by the v1.4.6 QA pass:

- Settings → KI: the "raw data" warning still used raw Tailwind orange
  tokens instead of the Dracula `dracula-orange` ones, breaking theme
  consistency and tipping below the WCAG-AA contrast floor on the
  card surface.
- Admin status grid: the Backups card cta read "View backups" but
  jumped to the system-status section (the dedicated backups view
  does not exist yet — that's a v1.5 feature). Re-labelling the cta
  to "Open system status" and the Integrations cta to "Open
  integrations" makes the destination honest. The href targets
  themselves are unchanged.
- `withIdempotency` body-content guard previously did `text.includes("sk-")`
  which silently broke caching for benign payloads containing common
  English compounds like "task-id", "risk-management", "disk-io".
  Tightened to a regex requiring the canonical secret prefix plus a
  realistic suffix length, so only actual API keys trip the guard.
  Three regression tests cover the false-positive cases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/admin/status-card-grid.tsx

@@ -157,7 +157,7 @@ export function buildCards(data: StatusOverview): StatusCardProps[] {
         { label: "Push", value: data.integrations.webPush },
       ],
       href: "/admin#section-admin-umami",
-      cta: "Configure",
+      cta: "Open integrations",
     },
     {
       title: "Monitoring",
@@ -187,7 +187,7 @@ export function buildCards(data: StatusOverview): StatusCardProps[] {
         { label: "Retain", value: `${data.backups.retentionDays}d` },
       ],
       href: "/admin#section-system-status",
-      cta: "View backups",
+      cta: "Open system status",
     },
     {
       title: "Maintenance",