consolidate samba passdb into system/ + add selinux step to runbook

RUNBOOK.md

@@ -127,6 +127,14 @@ for u in yireh isaac; do
     chown "$u":sambagroup "/opt/argento/smb/$u"
     chmod 2770 "/opt/argento/smb/$u"
 done
+
+# SELinux contexts for samba — fresh ZFS datasets get unlabeled_t and samba
+# refuses to serve them. Persistent rules (semanage) survive full relabels;
+# restorecon applies them now.
+semanage fcontext -a -t samba_share_t "/opt/argento/smb/media(/.*)?"
+semanage fcontext -a -t samba_share_t "/opt/argento/smb/yireh(/.*)?"
+semanage fcontext -a -t samba_share_t "/opt/argento/smb/isaac(/.*)?"
+restorecon -Rv /opt/argento/smb/
 ```
 
 ## 7b. Restore users
@@ -141,7 +149,8 @@ so file ownership lands on the correct UIDs.
 
 This recreates timothykim, yireh, isaac, and the sambagroup group with
 their original UIDs/GIDs, then restores the samba password hashes from
-`/mnt/backup/samba-private/` if present.
+`/mnt/backup/argento/system/samba-private/` if present (mirrored there
+by sync-system.sh, gitignored so the hashes aren't in version control).
 
 If the samba passdb backup is missing, set passwords manually: