refactor: harden restic configuration

move secrets to .env file so they work on their own, initialize restic repo on fresh deployments

roles/backup/templates/restic-backup.sh.j2

@@ -1,17 +1,17 @@
 #!/bin/bash
 ## Ansible managed
 
-## Secrets are passed via Ansible Vault variables
-export RESTIC_REPOSITORY="{{ vault_restic_repo_url }}"
-export RESTIC_PASSWORD="{{ vault_restic_password }}"
-export AWS_ACCESS_KEY_ID="{{ vault_aws_access_key }}"
-export AWS_SECRET_ACCESS_KEY="{{ vault_aws_secret_key }}"
-
 set -e
 
+# Source environment variables if running manually/outside Systemd
+if [ -f /etc/restic-backup.env ]; then
+  # shellcheck source=/dev/null
+  . /etc/restic-backup.env
+fi
+
 echo "Starting Restic Backup at $(date)"
 
-## Run the backup using paths and exclusions defined in group_vars
+## Run the backup using paths and exclusions defined as group_vars
 restic backup \
 {% for path in backup_include_paths %}
   "{{ path }}" \