restic/nh3-dev: add user workstation to backup scope

nh3-dev is the author's active dev workstation at the NH3 site
(nh3-dev.phasefinal.com). 22 GB home with 12 GB of development code,
shell history, dotfiles, Claude Code memory, and scripts that weren't
being captured by any fleet backup.

Writes site-local to the Synology rest-server (10.100.50.50:8000)
matching the nh3-docker pattern.

Excludes trim ~8 GB of regenerable caches + build outputs:
  - language toolchains (.cargo, .rustup, .npm, .m2, .gradle, go/pkg, etc.)
  - editor caches (.vscode-server, .vscode)
  - project build directories (node_modules, __pycache__, .venv, target,
    dist, build, .pytest_cache, .tox, .next, .nuxt) via `**/` patterns
  - trash / browser caches / steam / snap

Expected first snapshot ~14 GB, incrementals much smaller due to
content-defined dedup across dev code.

README walks through the full setup: resticprofile install, Synology-
side htpasswd addition (via DSM File Station or Container Manager since
the DSM SSH setup is tabled), repo init, profile deploy, timer enable,
first backup. Schedule is nightly 01:00 with systemd's Persistent=true
behavior so missed runs catch up at next boot (workstation is often
off/sleeping at backup time).

README.md fleet-coverage table updated to reflect 6/6 file-level
coverage (ana-docker, ana-ml2, nh3-docker, esh-docker-vm, vm-esh-nas,
nh3-dev).

configs/restic/nh3-dev/profiles.yaml

@@ -0,0 +1,115 @@
+# resticprofile config for nh3-dev.
+#
+# User workstation at the NH3 site (nh3-dev.phasefinal.com). Primary
+# payload is /home/lkraven — ~12 GB of active development code, shell
+# history, dotfiles, notes, Claude Code memory, etc. Not a server; no
+# Docker stacks to dump. No databases.
+#
+# Writes to the Synology rest-server at 10.100.50.50:8000 as user
+# `nh3-dev` — site-local, matches the pattern nh3-docker uses.
+#
+# Schedule accommodates a workstation that may be off/sleeping at the
+# scheduled time: systemd timer uses Persistent=true (resticprofile sets
+# this by default for schedule-permission: system) so a missed run
+# catches up on next boot.
+#
+# Excludes trim ~8 GB of regenerable caches from the 22 GB home. First
+# snapshot should land at ~14 GB; incrementals much smaller.
+
+version: "1"
+
+global:
+  priority: low
+  ionice: true
+  ionice-class: 2
+  ionice-level: 7
+  min-memory: 200   # workstation has more RAM than agents; give restic a bit more
+
+default:
+  env-file: /etc/restic/restic.env
+  env:
+    RESTIC_PASSWORD_FILE: /etc/restic/password
+  initialize: false
+  lock: /var/lock/restic-nh3-dev.lock
+
+  backup:
+    verbose: 1
+    run-after:
+      - date +%s > /var/lib/restic/last-success
+    source:
+      - /home/lkraven           # the whole reason this backup exists
+      - /etc                    # host config
+      - /root                   # root's state, ssh keys, etc.
+    exclude:
+      # ---- Language / toolchain caches (all regenerable) -------------------
+      - /home/lkraven/.cache
+      - /home/lkraven/.rustup
+      - /home/lkraven/.cargo/registry
+      - /home/lkraven/.cargo/git
+      - /home/lkraven/.npm
+      - /home/lkraven/.pnpm-store
+      - /home/lkraven/.m2
+      - /home/lkraven/.gradle
+      - /home/lkraven/.conda
+      - /home/lkraven/go/pkg
+      - /home/lkraven/.dotnet
+      # ---- Editor / remote-dev caches ---------------------------------------
+      - /home/lkraven/.vscode-server
+      - /home/lkraven/.vscode
+      # ---- Project build outputs (often committed to .gitignore) ------------
+      - "**/node_modules"
+      - "**/__pycache__"
+      - "**/.venv"
+      - "**/venv"
+      - "**/target"              # Rust/Java/other — regenerable from source
+      - "**/dist"
+      - "**/build"
+      - "**/.pytest_cache"
+      - "**/.tox"
+      - "**/.next"               # Next.js
+      - "**/.nuxt"               # Nuxt
+      # ---- Trash / shell noise ---------------------------------------------
+      - /home/lkraven/.local/share/Trash
+      - /home/lkraven/.mozilla/firefox/*/Cache*
+      - /home/lkraven/.thumbnails
+      - /home/lkraven/.zcompdump*
+      # ---- Browser profiles (if any) ----------------------------------------
+      - /home/lkraven/snap
+      - /home/lkraven/.steam
+      - /home/lkraven/Steam
+      # ---- Root side ---------------------------------------------------------
+      - /root/.cache
+      - /root/.npm
+      - /root/.local/share/Trash
+      # ---- Logs / pids ------------------------------------------------------
+      - "**/*.log"
+      - "**/*.log.*"
+      - "**/*.pid"
+    tag:
+      - host:nh3-dev
+      - site:nh3
+      - fleet:pfi
+      - role:workstation
+    schedule: "*-*-* 01:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-backup.log
+
+  forget:
+    keep-daily: 7
+    keep-weekly: 4
+    keep-monthly: 12
+    keep-yearly: 3
+    # NOTE: forget against an --append-only rest-server FAILS (delete ops
+    # blocked). Schedule left in for when the prune ceremony flips
+    # --append-only off temporarily. See open thread.
+    tag:
+      - host:nh3-dev
+    schedule: "*-*-* 03:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-forget.log
+
+  check:
+    read-data-subset: 10%
+    schedule: "Sun *-*-* 05:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-check.log