M5: notifications, setup check, audit log and password confirmation

- notifications to administrators for failed backup/restore runs and
  locations without a successful backup for two days (once a day)
- setup check in the admin overview: error when the key/kit is not set
  up, warning for missing, old or failed backups
- security events (recovery kit downloaded, location removed,
  append-only turned off, retention changed, snapshots forgotten) go to
  the audit log and are announced to all administrators, from the web
  and from occ; the scheduled weekly cleanup is logged only
- fix: the recovery-kit download link failed the CSRF check (412); it
  now requires a recent password confirmation instead, like creating the
  key, removing a location and restoring

lib/BackgroundJob/BackupJob.php

@@ -27,6 +27,7 @@ class BackupJob extends TimedJob {
 		ITimeFactory $time,
 		private BackupService $backups,
 		private \OCA\NgBackup\Service\PruneService $prune,
+		private \OCA\NgBackup\Service\AlertService $alerts,
 		private TargetService $targets,
 		private RunMapper $runs,
 		private IAppConfig $appConfig,
@@ -47,6 +48,9 @@ class BackupJob extends TimedJob {
 			}
 		}
 		$this->weeklyPrune();
+		foreach ($this->targets->list() as $t) {
+			$this->alerts->checkStale($t);
+		}
 	}
 
 	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
@@ -60,7 +64,7 @@ class BackupJob extends TimedJob {
 				continue;
 			}
 			try {
-				$this->prune->apply($t);
+				$this->prune->apply($t, false, true);
 			} catch (\Throwable $e) {
 				$this->logger->warning('NG Backup: cleanup of ' . $t->getName() . ' failed: ' . $e->getMessage());
 			}