Merge the release into the backup health work and read the real dump health

The readiness model now takes the database dump's state from
getDatabaseBackupHealth, and the dump test reaches the off-host key id
where it moved.

prisma/migrations/0486_database_backup_runs/migration.sql

@@ -0,0 +1,30 @@
+-- The nightly whole-database dump records each run: whether a dump was
+-- written in DB_BACKUP_DIR and copied to the off-host bucket, and why not.
+-- Instance metadata with no account; the admin backups card and the backup
+-- alerts read the newest rows.
+--
+-- The table is new, so nothing waits on its lock in practice; the wait is
+-- bounded in a DO block anyway, and every statement is safe to run again, so
+-- the boot retries the file on a lock timeout.
+--
+-- @retry-on-lock-timeout
+
+DO $migration$
+BEGIN
+    PERFORM set_config('lock_timeout', '5s', true);
+    CREATE TABLE IF NOT EXISTS "database_backup_runs" (
+        "id" TEXT NOT NULL,
+        "started_at" TIMESTAMP(3) NOT NULL,
+        "finished_at" TIMESTAMP(3),
+        "status" TEXT NOT NULL,
+        "file_name" TEXT,
+        "dump_bytes" BIGINT,
+        "local_result" TEXT NOT NULL,
+        "offhost_result" TEXT NOT NULL,
+        "error" TEXT,
+        CONSTRAINT "database_backup_runs_pkey" PRIMARY KEY ("id")
+    );
+    CREATE INDEX IF NOT EXISTS "database_backup_runs_started_at_idx"
+        ON "database_backup_runs"("started_at");
+END
+$migration$;

prisma/schema.prisma

@@ -5978,6 +5978,35 @@ model OffhostPurgeRequest {
   @@map("offhost_purge_requests")
 }
 
+/// One run of the nightly whole-database dump (the `database-backup` job):
+/// whether a dump was written on this server and copied off-host, and why not
+/// when it was not. Instance metadata, not an account's data. Written by
+/// `runDatabaseBackup`; read by `getDatabaseBackupHealth`, which feeds the
+/// database row of the admin backups card and the backup alerts. A row left
+/// `running` by a process that died is read as a failed run once the job's
+/// expiry has passed.
+model DatabaseBackupRun {
+  id            String    @id @default(cuid())
+  startedAt     DateTime  @map("started_at")
+  finishedAt    DateTime? @map("finished_at")
+  /// `running`, `succeeded`, `failed` or `skipped`.
+  status        String
+  /// The dump's file name, once one was written and checked.
+  fileName      String?   @map("file_name")
+  /// Size of the dump in bytes.
+  dumpBytes     BigInt?   @map("dump_bytes")
+  /// `written` (kept in DB_BACKUP_DIR), `no_directory` (no writable
+  /// directory, the dump went off-host only), or `failed`.
+  localResult   String    @map("local_result")
+  /// `uploaded`, `not_configured` or `failed`.
+  offhostResult String    @map("offhost_result")
+  /// Why the run failed or was skipped, trimmed. Never key material.
+  error         String?
+
+  @@index([startedAt])
+  @@map("database_backup_runs")
+}
+
 // ─── Apple Health export.zip import (v1.4.34) ───────────────
 //
 // Mirrors a `pg-boss` `apple-health-import` job's lifecycle so the