move git checkout before git-crypt unlock

git-crypt refuses to unlock if the working directory is dirty.

setup.sh

@@ -42,6 +42,9 @@ fi
 
 # --- Unlock git-crypt via Bitwarden ---
 
+echo "==> Restoring git-tracked files..."
+cd "$REPO_DIR" && git checkout -- .
+
 echo "==> Unlocking git-crypt via Bitwarden..."
 echo "    Log in to Bitwarden when prompted."
 if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
@@ -91,9 +94,6 @@ chmod +x "$REPO_DIR/scripts/"*.sh
 echo "==> Logging into Gitea registry..."
 echo "Run manually: docker login git.timothykim.net"
 
-echo "==> Restoring git-tracked files..."
-cd "$REPO_DIR" && git checkout -- .
-
 echo "==> Starting services..."
 cd "$REPO_DIR/docker/nginx" && docker compose up -d
 cd "$REPO_DIR/docker/timothykim.net" && docker compose up -d