M5: deletion delay with trash, passphrase slots, ransomware documentation

- removed snapshots go to a trash on the location and their data is only
  freed after the deletion delay, which is chosen when the key is created
  (default 7 days, 1-365) and cannot be changed afterwards; any admin can
  bring them back (occ backup:trash, backup:trash:restore, web UI)
- up to three passphrase slots open the same master key (like LUKS), so
  one person leaving or dying does not lock the company out; slot changes
  are written to every location, announced to all admins and require a
  new recovery kit confirmation, while backups keep running
- occ backup:key:slots, backup:key:slot:add|replace|remove; key init takes
  --label and --delete-delay-days
- web UI: deletion delay and first slot at key creation, slot management,
  trash per location with restore; all behind password confirmation
- README: key, slots (safe / CTO / head of IT), and protection against
  ransomware: object lock in compliance mode (e.g. 90 days), credentials
  without delete rights, provider snapshots, off-site copy

lib/SetupCheck/BackupStatusCheck.php

@@ -39,9 +39,12 @@ class BackupStatusCheck implements ISetupCheck {
 
 	public function run(): SetupResult {
 		$link = $this->url->linkToRouteAbsolute('settings.AdminSettings.index', ['section' => 'ng_backup']);
-		if (!$this->keys->isInitialized() || $this->keys->recoveryKitConfirmation() === null) {
+		if (!$this->keys->isInitialized() || !$this->keys->everConfirmed()) {
 			return SetupResult::error($this->l->t('Backups are not set up: create the backup key and confirm the recovery kit.'), $link);
 		}
+		if ($this->keys->recoveryKitConfirmation() === null) {
+			return SetupResult::error($this->l->t('The backup passphrase was changed: download and confirm the new recovery kit.'), $link);
+		}
 		$targets = $this->targets->list();
 		if ($targets === []) {
 			return SetupResult::warning($this->l->t('No backup location is configured.'), $link);