Ask before installing user_migration; add the beta how-to

backup:user:backup and backup:user:restore now ask the administrator before
installing or enabling user_migration (or take --install-user-migration), so
nothing changes on the server without consent. The restore warns that
user_migration imports only its allowlisted app settings.

Also: a clear error for unknown locations instead of a raw database message;
prune reports the number of affected users, not the number of kept ones; and
--user-last rejects values that are not whole numbers. Adds docs/HOWTO.md and
updates the README and PLAN.md for the beta.

lib/Command/Retention.php

@@ -50,8 +50,13 @@ final class Retention extends Command {
 			}
 		}
 		if ($input->getOption('user-last') !== null) {
+			$userLast = (string)$input->getOption('user-last');
+			if (!ctype_digit($userLast)) {
+				$output->writeln('<error>--user-last must be a whole number</error>');
+				return 1;
+			}
 			try {
-				$this->prune->setUserExportRetention((int)$input->getOption('user-last'));
+				$this->prune->setUserExportRetention((int)$userLast);
 			} catch (\InvalidArgumentException $e) {
 				$output->writeln('<error>' . $e->getMessage() . '</error>');
 				return 1;