Replace a backup key that was never used by the key of existing backups

A key made by mistake on a server that is being restored left no way back: key:import and the
passphrase route refused because a key existed, and nothing removed it. As long as the key never
protected anything (no location created or adopted with it, no location or run in the database),
occ backup:key:import --replace-unused-key and occ backup:target:add --replace-unused-key replace
it, after the new key was opened. A key that was used is never replaced, also after its location
was removed. The refusal names the option, and all administrators are notified of a replacement.

CHANGELOG.md

@@ -37,7 +37,11 @@ shown under 1.0.0. The git tag of a release candidate goes after the date.
 - `occ backup:target:add --repair-config`: when the config file of a location is gone, the recovery
   kit writes it again (for locations backed up by this version or newer). Before, the message said
   this was possible, but it was not.
-- The key page warns against creating a new key when you are restoring a server.
+- The key page warns against creating a new key when you are restoring a server. A key made there
+  by mistake can still make way for the key of the backups, as long as it was never used (no
+  location, no backup): `occ backup:key:import --replace-unused-key` with the kit, or
+  `occ backup:target:add --replace-unused-key` with a passphrase of the old server. A key that
+  protected a location is never replaced. All administrators are notified of a replacement.
 
 ### Changed
 - Reading files for a backup is much faster on disks where every request waits, such as network and