feat(backups): per-config opt-out of the retention floor

[passcod]

🤖 The org retention floor (keep_daily 7 / weekly 4 / monthly 6) is right for the common case, but some backups are taken for data processing we're not authorised to keep beyond a few days. This drops the floor as an unconditional rule: it stays the default, but each retention config can opt out.

What changed

• New allow_below_floor boolean on backup_type_defaults and server_group_backup_schedule (migration, defaults false).
• When set, the floor is neither validated on write (set_type_default / set_schedule) nor enforced when the policy is resolved for kopia (resolve_policy). The flag travels with the winning retention source through resolution, so a dangerous override or dangerous default exempts only its own type — everything else still gets the floor.
• Both retention UIs — the canopy-wide defaults editor and the per-(group,type) override editor — gain a 'dangerous' toggle that drops the floor validation and input minimums, with a warning, plus a 'below floor' chip on the summary.

Scope decisions

• The floor constants stay as the default; the toggle is a per-row opt-out (not a global kill-switch).
• The kopia layer is unchanged: per-source policies are set from the resolved (possibly un-floored) retention, and the global init baseline stays the strictest-across-types fallback.

Tests: scheduler unit tests for the new resolve path, private-server endpoint tests for accept-below-floor-with-flag on both endpoints, and Playwright coverage for both toggles.

Tag: TAM-6877