fix(restic): stop publishing rest-server passwords in systemd units

resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.

New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
  profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.

Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.

restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.

vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.

Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.

configs/restic/ana-docker/profiles.yaml

@@ -2,8 +2,8 @@
 #
 # Writes to the Anaheim-side rest-server at 10.250.50.70 as user
 # `ana-docker`. The full REST URL (including HTTP basic-auth creds)
-# lives in /etc/restic/restic.env — loaded via env-file so this YAML
-# carries zero secrets and is safe to version-control.
+# lives in /etc/restic/repository (root 0400), read via repository-file, so
+# this YAML carries zero secrets and is safe to version-control.
 #
 # The client-side encryption passphrase lives in /etc/restic/password.
 
@@ -17,7 +17,9 @@ global:
   min-memory: 100
 
 default:
-  env-file: /etc/restic/restic.env          # provides RESTIC_REPOSITORY=rest:http://user:pw@…
+  repository-file: /etc/restic/repository  # URL incl. rest-server creds (root 0400).
+  # NOT env-file: `resticprofile schedule` copies env-file values into the
+  # world-readable systemd units (docs/runbooks/backups.md, Known gaps).
   env:
     RESTIC_PASSWORD_FILE: /etc/restic/password
   initialize: false                         # repo was created by `restic init`