consolidate samba passdb into system/ + add selinux step to runbook

scripts/restore-users.sh

@@ -117,18 +117,19 @@ done
 
 echo ""
 echo "=== samba passdb ==="
+PASSDB_SRC=/mnt/backup/argento/system/samba-private
 if ! mountpoint -q /mnt/backup; then
     echo "[!] /mnt/backup is not mounted — skipping samba passdb restore"
     echo "    mount the USB backup drive (RUNBOOK step 5) and re-run if you want"
     echo "    to restore preserved SMB passwords; otherwise set them manually:"
     echo "      for u in timothykim yireh isaac; do smbpasswd -a \"\$u\"; done"
-elif [ -f /mnt/backup/samba-private/passdb.tdb ]; then
+elif [ -f "$PASSDB_SRC/passdb.tdb" ]; then
     install -d -m 700 /var/lib/samba/private
-    cp /mnt/backup/samba-private/*.tdb /var/lib/samba/private/
+    cp "$PASSDB_SRC"/*.tdb /var/lib/samba/private/
     chmod 600 /var/lib/samba/private/*.tdb
-    echo "[+] restored samba passdb from /mnt/backup/samba-private/"
+    echo "[+] restored samba passdb from $PASSDB_SRC/"
 else
-    echo "[!] no samba passdb backup found at /mnt/backup/samba-private/"
+    echo "[!] no samba passdb backup found at $PASSDB_SRC/"
     echo "    run: for u in timothykim yireh isaac; do smbpasswd -a \"\$u\"; done"
 fi