docs(backups): harden + live-activate /mnt/compose automount on ana-docker

docs/runbooks/backups.md

@@ -160,8 +160,10 @@ the stop→umount→rm-ghost→remount→start variant.
 - [x] **fstab hardening — DONE (2026-06-20).** ana-docker `/mnt/backup` →
       `noauto,x-systemd.automount,x-systemd.mount-timeout=30` (autofs self-heals
       on a NAS blip instead of getting stuck `failed`; activates on next reboot).
-      `/etc/fstab.bak-pre-harden` saved. **NOTE:** `/mnt/compose` is still bare
+      `/etc/fstab.bak-pre-harden` saved. **`/mnt/compose` also hardened the same
-      `defaults` (same latent risk) — harden it the same way when convenient.
+      way** and **activated live** (umount → `mnt-compose.automount` started →
+      autofs verified remounting on access) — it binds no container, so it was
+      safe to convert now; this also proved the autofs pattern works on ana-docker.
 - [ ] **ana-ml2 has no PBS net** (bare metal) — restic is its only layer; now
       healthy + alerted. Bulk `/tank` models are re-downloadable; bespoke
       quants/configs/scripts are the real loss-risk.

persistent-memory.md

@@ -206,8 +206,9 @@ _As of 2026-06-20:_
   (2) fstab hardened — ana-docker `/mnt/backup` → `noauto,x-systemd.automount,…`
   (autofs self-heals, active next boot; `.bak-pre-harden` saved); (3) esh-pve-nas
   VERIFIED **not** PBS-covered → esh-vm-db (a DB!) + vm-esh-nas are restic-only.
-  STILL OPEN: rotate the 5 rest-server creds (operator, offline); harden
+  `/mnt/compose` ALSO hardened + automount activated live (2026-06-20, binds no
-  `/mnt/compose` too (also bare defaults); the 3 esh + ana-docker restic clients
+  container — proved the autofs pattern works on ana-docker). STILL OPEN: rotate the
+  5 rest-server creds (operator, offline); the 3 esh + ana-docker restic clients
   clear at tonight's 01:00.
 
 - **ana-docker disk incident RESOLVED — root cause was a 94 GB unrotated