consolidate samba passdb into system/ + add selinux step to runbook

scripts/backup.sh

@@ -40,17 +40,14 @@ for db in jellyfin library; do
         || FAILURES+=("jellyfin ${db} sqlite backup")
 done
 
-# Single rsync covers everything: configs, app data, media, DB dumps
+# Single rsync covers everything: configs, app data, media, DB dumps,
+# and the samba passdb (mirrored into /opt/argento/system/samba-private/
+# by sync-system.sh, gitignored)
 RSYNC_OPTS="-a --delete"
 [ -t 1 ] && RSYNC_OPTS="$RSYNC_OPTS --info=progress2"
 rsync $RSYNC_OPTS /opt/argento/ /mnt/backup/argento/ \
     || FAILURES+=("rsync argento")
 
-# Back up samba passdb (binary — holds SMB password hashes, not in /opt/argento)
-mkdir -p /mnt/backup/samba-private
-rsync -a --delete /var/lib/samba/private/ /mnt/backup/samba-private/ \
-    || FAILURES+=("rsync samba passdb")
-
 if [ ${#FAILURES[@]} -gt 0 ]; then
     echo "BACKUP FAILED: ${FAILURES[*]}" >&2
     exit 1