fix(restic): stop publishing rest-server passwords in systemd units

resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.

New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
  profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.

Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.

restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.

vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.

Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.

configs/restic/esh-ml1/README.md

@@ -29,13 +29,13 @@ Tested by making it fail (2026-09-27): with a stub `docker` that exits 1 on PATH
 `resticprofile backup` returned 1, the snapshot count stayed 1 → 1, and
 `last-success` did not move.
 
-## ⚠ Deviation from the other hosts: `repository-file`, not `restic.env`
+## `repository-file`, not `restic.env` (now the fleet standard)
 
 `resticprofile schedule` copies `env-file` values into the generated systemd
-units, which are world-readable. On the env-file hosts that publishes the
-rest-server password to every local user (see `docs/runbooks/backups.md` →
-Known gaps). Here the URL lives in `/etc/restic/repository` (root 0400) and the
-unit carries only the path. The playbook's verify step fails if a unit ever
+units, which are world-readable. That published the rest-server password on
+every other host until 2026-09-27, when the rest of the fleet was moved to this
+pattern (see `docs/runbooks/backups.md` → Known gaps). Here the URL lives in
+`/etc/restic/repository` (root 0400), and the unit carries only the path. The playbook's verify step fails if a unit ever
 contains `rest:http`.
 
 ## Secrets (seeded by hand; never in this repo)

configs/restic/esh-ml1/profiles.yaml

@@ -8,13 +8,13 @@
 # Writes cross-site to rest-server-ana (10.250.50.70:8000/esh-ml1/) because
 # the ESH site has no local rest-server (same as esh-docker-vm / esh-vm-db).
 #
-# ⚠ DELIBERATE DEVIATION from the other hosts: the repository URL (which
-# embeds the rest-server basic-auth password) is read from
-# /etc/restic/repository via `repository-file`, NOT from an env-file.
+# The repository URL (which embeds the rest-server basic-auth password) is
+# read from /etc/restic/repository via `repository-file`, NOT from an env-file.
 # `resticprofile schedule` copies env-file values into the generated systemd
-# unit, and units under /etc/systemd/system are world-readable (0644), so
-# the env-file pattern publishes the credential to every local user. With
-# repository-file the unit carries only the path. See README.md.
+# unit, and units under /etc/systemd/system are world-readable (0644), so the
+# env-file pattern publishes the credential to every local user. With
+# repository-file the unit carries only the path. See README.md. (esh-ml1 was
+# first; the rest of the fleet moved to repository-file on 2026-09-27.)
 #
 # ⚠ The CT runs in UTC; the schedules carry an explicit zone so they fire at
 # the same wall-clock time as the rest of the fleet.