Let the additional-mirror setup read Garage credentials over SSH

Extends the "ADDITIONAL MIRROR" section (previously SFTP-only) with a
type choice: SFTP, or S3 against a Garage instance already running on
that box. For the S3 path, this script never asks the operator to retype
a bucket name or key — it SSHes to the destination, reads
~/docker/garage/.env directly (the real, currently-configured values,
generated once by services/garage.sh and never touched again on its own
Update runs), and uses those for the dry-run verification and the
persisted mirror args. If Garage isn't installed there yet, it says so
plainly with the exact install command instead of failing cryptically or
silently skipping.

Also removed the last hardcoded suggestions from services/garage.sh
itself ("kopia-backup" / "kopia" as fixed prompt defaults) — replaced
with a freshly-generated suggestion each run (timestamp-suffixed), so
nothing about the bucket/key name is a fixed string baked into this repo
at any point in the chain; it's always the operator's actual choice, read
back live wherever it's needed.

Verified end-to-end against a mocked ssh (returning realistic
~/docker/garage/.env content) covering both outcomes: Garage installed
with a real bucket/key correctly parsed, dry-run run, and persisted; and
Garage missing, correctly warning with the install command and leaving
backup.conf untouched either way.

services/garage.sh

@@ -174,11 +174,16 @@ install_garage() {
     find_free_port RPC_PORT "$RPC_PORT"
     find_free_port ADMIN_PORT "$ADMIN_PORT"
 
+    # Suggested defaults are generated fresh at runtime, not fixed strings
+    # baked into this script — same reasoning as not hardcoding what a
+    # remote reader (services/backup.sh) should expect the name to be:
+    # this is the operator's name to pick, not this repo's.
     local BUCKET_NAME="" KEY_NAME=""
-    prompt_text "  Bucket name:" "kopia-backup" BUCKET_NAME
-    BUCKET_NAME="${BUCKET_NAME:-kopia-backup}"
-    prompt_text "  Access key name:" "kopia" KEY_NAME
-    KEY_NAME="${KEY_NAME:-kopia}"
+    local _default_bucket="kopia-$(date +%s)" _default_key="key-$(date +%s)"
+    prompt_text "  Bucket name:" "$_default_bucket" BUCKET_NAME
+    BUCKET_NAME="${BUCKET_NAME:-$_default_bucket}"
+    prompt_text "  Access key name:" "$_default_key" KEY_NAME
+    KEY_NAME="${KEY_NAME:-$_default_key}"
 
     mkdir -p "$DIR"/{data,meta}
     ensure_docker_dir_ownership "$DIR"
@@ -232,6 +237,11 @@ COMPOSE
 
     cat > .env << ENV
 TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
+
+# Read directly (over SSH) by another box's services/backup.sh when adding
+# this instance as a Kopia sync-to s3 mirror target — keep this key name
+# stable, other scripts depend on it.
+GARAGE_S3_API_PORT=${S3_API_PORT}
 ENV
     chmod 600 .env