fix(restic): stop publishing rest-server passwords in systemd units

resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.

New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
  profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.

Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.

restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.

vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.

Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.

persistent-memory.md

@@ -142,6 +142,16 @@ _As of 2026-09-26 ~1620 PT._
   commissioning misbehaves, the UniFi mDNS reflector on esh-iot is the first knob
   (a Prime/infra-ops change). → `servers/esh-matter/README.md`
 
+### restic: credential leak fixed (2026-09-27, Prime)
+
+- Seven hosts were moved from `env-file` to `repository-file` (`playbooks/restic-repository-file.yaml`),
+  so the systemd units no longer carry the rest-server password. Secrets are vaulted as
+  `<host>/etc/restic/{repository,password}`. `restic.env` is KEPT for manual snippets, so
+  **a rotation must update the vault, `restic.env` and `repository`.**
+- **vm-esh-nas is still leaking**, because infra-ops has no account there. Prime runs
+  `ssh -t vm-esh-nas 'sudo bash ~/restic-repofile-migrate.sh'`. Its secrets are not vaulted.
+- The passwords were readable until today, so the rotation (Prime's) remains the real fix.
+
 ### augaman: face recognition for Cicada
 
 - **v0.1.2 LIVE on esh-ml1:8040** (2026-09-27; v0.1.1 first deployed 2026-09-26 2347 PT),