docs(pbs): promote /web from develop — keyfile UX refresh

- Explicit yes/no escrow choice reinforced ("nothing gets uploaded to PBS
  until the operator answers Yes") in intro + recoveryTitle + recoveryBody
- Wrong-key detection: recoverBody extended to describe the structured
  amber panel that Monitor shows on View contents / Download / Restore
  when the installed keyfile doesn't match the backup's manifest, with
  the required fingerprint rendered prominently
- New encryption.monitorManagement section: describes the Download /
  Upload / Delete inline actions in each PBS destination row, plus the
  Yes/No + passphrase + contextual Apply escrow toggle
- ES: "operador" → "usuario" throughout (glossary rule)
- page.tsx: renders the new subsection and passes {code, em, strong} to
  the extended recoveryBody

web/app/[locale]/docs/backup-restore/destinations/pbs/page.tsx

@@ -217,7 +217,7 @@ export default async function PbsDestinationPage({
       </h3>
 
       <p className="mb-4 text-gray-800 leading-relaxed">
-        {t.rich("encryption.recoveryBody", { code })}
+        {t.rich("encryption.recoveryBody", { code, em, strong })}
       </p>
 
       <h3 className="text-lg font-semibold mt-6 mb-3 text-gray-900">
@@ -271,6 +271,14 @@ export default async function PbsDestinationPage({
         {t.rich("encryption.recoverBody", { code })}
       </p>
 
+      <h3 className="text-lg font-semibold mt-6 mb-3 text-gray-900">
+        {t("encryption.monitorManagementTitle")}
+      </h3>
+
+      <p className="mb-6 text-gray-800 leading-relaxed">
+        {t.rich("encryption.monitorManagementBody", { code, em })}
+      </p>
+
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">
         {t("restoreAccess.heading")}
       </h2>