fix(restic): stop publishing rest-server passwords in systemd units

resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.

New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
  profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.

Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.

restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.

vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.

Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.

docs/runbooks/backups.md

@@ -178,7 +178,7 @@ the stop→umount→rm-ghost→remount→start variant.
 
 ## Known gaps / TODO
 
-### ⚠ `resticprofile schedule` publishes the repo credential (found 2026-09-27)
+### ✅ `resticprofile schedule` published the repo credential (found and fixed 2026-09-27, except vm-esh-nas)
 
 On a host whose profile loads `RESTIC_REPOSITORY` from `env-file:
 /etc/restic/restic.env`, `resticprofile schedule` copies that value, **including
@@ -191,11 +191,24 @@ a caller read the encrypted blobs and append to that one repo (rest-server is
 `--append-only`, and the encryption passphrase is a separate file). It does not
 decrypt anything.
 
-**esh-ml1 does not have this problem:** its profile uses `repository-file:
-/etc/restic/repository` (root 0400), so the unit carries only the path, and
-`playbooks/esh-ml1-restic.yaml` verifies that no unit contains `rest:http`.
-Moving the other hosts to `repository-file` is not done; it belongs with the
-(operator-held) rest-server password rotation below.
+**Fixed 2026-09-27 (Prime):** ana-docker, fv-ml1 (`configs/restic/ana-ml2`),
+esh-docker-vm, esh-vm-db, irv-ml1, nh3-dev and nh3-docker were moved to
+`repository-file: /etc/restic/repository` (root 0400) by
+`playbooks/restic-repository-file.yaml`. esh-ml1 was built that way. The playbook's
+verify step, plus an independent check across all eight hosts, found no unit
+containing `rest:http`. nh3-docker's scheduled unit then ran a real backup (snapshot
+`a29b889d`). All seven hosts' URLs and passphrases are now vaulted as
+`<host>/etc/restic/{repository,password}`.
+
+**Still open: vm-esh-nas.** infra-ops has no account there, so its unit still
+leaks. The migration script is staged at `~lkraven/restic-repofile-migrate.sh`
+(repo copy `configs/restic/vm-esh-nas/migrate-repository-file.sh`), and Prime runs
+it with `ssh -t vm-esh-nas 'sudo bash ~/restic-repofile-migrate.sh'`. Its secrets are
+not vaulted yet, because that needs root there.
+
+The passwords themselves were readable until the move, so the **rotation below is
+still the real fix**. On rotation, update the vault, `restic.env` and `repository`
+on each host.
 
 ### ✅ restic content assertion (2026-09-22, CLOSED)