fix(restic): stop publishing rest-server passwords in systemd units

resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.

New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
  profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.

Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.

restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.

vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.

Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.

configs/restic/vm-esh-nas/migrate-repository-file.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# vm-esh-nas: move restic from env-file to repository-file (2026-09-27).
+# The same change playbooks/restic-repository-file.yaml made on the seven hosts
+# where infra-ops has sudo. vm-esh-nas has no infra-ops account, so run it as:
+#   ssh -t vm-esh-nas 'sudo bash ~/restic-repofile-migrate.sh'
+# It edits the env-file line IN PLACE (the live profile cannot be diffed without
+# root, so any drift is preserved), and restores the old profile if a check fails.
+set -eu
+cd /etc/restic
+grep -q '^ *env-file: /etc/restic/restic.env' profiles.yaml \
+  || { echo "no env-file line: already migrated, or the profile differs; nothing done"; exit 1; }
+val=$(sh -c 'set -a; . /etc/restic/restic.env; printf %s "$RESTIC_REPOSITORY"')
+case "$val" in rest:http*) ;; *) echo "RESTIC_REPOSITORY is not a rest: URL; nothing done"; exit 1;; esac
+umask 077
+printf '%s\n' "$val" > repository.new
+chown root:root repository.new; chmod 0400 repository.new; mv repository.new repository
+unset val
+cp -p profiles.yaml profiles.yaml.bak-20260927-envfile
+trap 'cp -p profiles.yaml.bak-20260927-envfile profiles.yaml; resticprofile --no-ansi --config /etc/restic/profiles.yaml --name default schedule >/dev/null 2>&1 || true; echo "FAILED: old profile restored"' ERR
+sed -i 's|^\( *\)env-file: /etc/restic/restic.env.*$|\1repository-file: /etc/restic/repository  # not env-file: schedule copies env-file values into world-readable units|' profiles.yaml
+resticprofile --no-ansi --config /etc/restic/profiles.yaml --name default cat config >/dev/null
+resticprofile --no-ansi --config /etc/restic/profiles.yaml --name default schedule >/dev/null
+for u in backup check; do
+  f=/etc/systemd/system/resticprofile-$u@profile-default.service
+  test -f "$f"
+  ! grep -q 'rest:http' "$f"
+done
+systemctl is-active --quiet resticprofile-backup@profile-default.timer
+trap - ERR
+echo "vm-esh-nas migrated: units carry no repository URL, backup timer active"

configs/restic/vm-esh-nas/profiles.yaml

@@ -27,7 +27,7 @@ global:
   min-memory: 100
 
 default:
-  env-file: /etc/restic/restic.env
+  repository-file: /etc/restic/repository  # not env-file: schedule copies env-file values into world-readable units
   env:
     RESTIC_PASSWORD_FILE: /etc/restic/password
   initialize: false