Backup credentials (4): detection — group-scoped issues, staleness/reconcile

[passcod]

🤖 Component (4), detection half — group-level backup alerting + staleness/reconciliation. Stacked on the component-2 PR (base component-public-server); review that and #223 first.

• Option-B group-scoped issues migration: issues.server_id becomes nullable and a nullable server_group_id is added (exactly-one-of CHECK, partial unique/last_seen indexes), so control-plane alerts can point at a group and page regardless of any member's is_monitored.
• database::backup module: the (source, ref) alert-key contract, raise_group_event (the single group-scoped incident entrypoint, consumed by the inspection Job and PGRO too), signal-1 staleness (+ maintenance staleness), and signal 1↔2 reconciliation.
• crates/jobs/src/bin/backup_staleness.rs: the minute-cadence DB-only sweep loop.
• commons-servers::backup_jobs::jitter_slot: shared per-group hash-jitter (preflight + maintenance + inspection schedulers).
• Completes the Option-B Issue.server_id-nullable sweep across all consumers: statuses.rs (reachability), commons-servers/tailnet_sweeps.rs, private-server/fns/issues.rs (IssueData.server_id now nullable); openapi.json + api-types.ts regenerated.
• Tests: database suite 86/86 (regression-clean across the nullable change), jitter_slot 8/8.

Deferred to a follow-up: the backup_preflight bin (AWS STS/S3 upstream checks) — it needs aws-sdk-s3 and live-AWS verification, so it's not in this PR.

🤖 Generated with Claude Code

Part of TAM-6877.