docs: document rest-server-ana data layout + repo-recreate flow

rest-server-ana README now describes the /mnt/backup/restic/repo/
top-level NFS mount and its three per-site subdirs:

  ana/ — live data served by this rest-server (per-host repos +
         .htpasswd) — what DATA_DIR points at
  esh/ — mirror destination for ESH-site backups (pending)
  nh3/ — mirror destination for NH3 Synology's tree (pending)

ana-ml2 README gains a proper "Recreating the repo" section with the
correct /mnt/backup/restic/repo/ana/ana-ml2/ path for wiping the old
repo after a lost passphrase, and two paths for regenerating keys:

  - interactive: type a user-generated passphrase at restic's init
    prompt, then install it into /etc/restic/password via `cat > file`
    + Ctrl-D (no shell history or transcript exposure)
  - scripted: openssl rand -base64 48, passphrase prints once and must
    be captured into the password manager immediately

Cross-site replication snippet in rest-server-ana README updated to
use the unified /mnt/backup/restic/repo/{esh,nh3}/ destinations
instead of the earlier restic-mirror-*/ staging paths.

stacks/rest-server-ana/README.md

@@ -4,7 +4,21 @@ Anaheim-site restic backup endpoint. Replaces the older `restic` stack on ana-do
 
 **Server:** ana-docker (`10.250.50.70`)
 **Port:** `http://10.250.50.70:8000`
-**Data:** `/mnt/backup/restic/repo/ana/` (NFS mount on the host, served by the Debian file server at `10.250.50.50`)
+**Data root:** `/mnt/backup/restic/repo/` (NFS mount on the host, served by the Debian file server at `10.250.50.50`)
+
+## Data layout
+
+The NFS export at `/mnt/backup/restic/repo/` is partitioned by site into three sibling subdirs:
+
+| Path | Role |
+|---|---|
+| `/mnt/backup/restic/repo/ana/` | **Live data served by this rest-server.** Each Anaheim-side host writes its repo under here (e.g. `ana/ana-docker/`, `ana/ana-ml2/`). `.htpasswd` also lives here. |
+| `/mnt/backup/restic/repo/esh/` | Destination for mirroring ESH-site backups to Anaheim (cross-site redundancy; not yet wired up). |
+| `/mnt/backup/restic/repo/nh3/` | Destination for mirroring NH3-site backups (from the Synology `rest-server-nh3`) into Anaheim. Same — pending. |
+
+The rest-server container is configured with `/mnt/backup/restic/repo/ana` as its data root (see compose's `DATA_DIR` env), so clients use URLs of the form `rest:http://user:pw@10.250.50.70:8000/<host>/` — the `<host>` path is relative to `ana/`.
+
+The two mirror dirs (`esh/`, `nh3/`) aren't served by restic at all; they're rsync destinations.
 
 Paired with:
 - **`rest-server-nh3`** on the Synology (`10.100.50.50:8000`, data on Btrfs).
@@ -131,13 +145,20 @@ If you go the second-endpoint route, copy this stack to `stacks/rest-server-ana-
 
 ## Off-site replication
 
-Scheduled on ana-docker (to be written):
+Scheduled on ana-docker (to be written). Mirror destinations live in the
+sibling subdirs described under "Data layout" above:
 
 ```bash
-# Pull NH3's tree down to this side
-rsync -avz --delete admin@10.100.50.50:/volume1/Backup/restic/ /mnt/backup/restic-mirror-nh3/
-# Push our tree to NH3
+# Pull NH3's tree into ana-docker's /mnt/backup/restic/repo/nh3/
+rsync -avz --delete admin@10.100.50.50:/volume1/Backup/restic/ /mnt/backup/restic/repo/nh3/
+
+# Pull the ESH rest-server's tree into /mnt/backup/restic/repo/esh/
+# (once an ESH rest-server is set up — currently ESH hosts write directly
+# to this Anaheim rest-server at ana/esh-*)
+
+# Push our tree (ana/) to NH3 for redundancy in the other direction
 rsync -avz --delete /mnt/backup/restic/repo/ana/ admin@10.100.50.50:/volume1/Backup/restic-mirror-ana/
 ```
 
-Two unidirectional syncs, each running in the direction its data flows. Prune runs only at the origin so the mirror shrinks correctly.
+Each sync unidirectional, running in the direction its data flows. Prune
+runs only at the origin so the mirror shrinks correctly.