Reuse an existing destination's repository password on re-run

Confirmed live: backup.sh has no update/fresh distinction and re-runs
every prompt on every invocation, including the repository password
prompt — which always minted a fresh (typed or auto-generated) password
regardless of whether a repo already existed at that destination's path.
Re-running the installer (to add a destination, configure the new B2
offsite mirror, or just by habit) then fails to connect to the real,
already-populated repo with "invalid repository password", because the
repo's actual password is permanently whatever was set the first time
and nothing read that back.

Each destination's password is now read back from the existing
backup.conf (if that destination name was already configured there)
before falling through to prompt/auto-generate — same pattern already
applied to REMOTE_TYPE/REMOTE_ARGS, EMBEDDED_COTURN_SLOT, and everywhere
else in this session that re-running a script with no update/fresh gate
turned out to silently regenerate something it shouldn't have. Verified
against a mock backup.conf: an existing destination's password is reused
verbatim, and a genuinely new destination name still falls through to
fresh generation correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/backup.sh

@@ -397,11 +397,26 @@ install_backup() {
     fi
 
     # ── 5. Passwords ─────────────────────────────────────────────────────────
+    # A destination's password is read back from an existing backup.conf
+    # (if this destination name was already configured) rather than
+    # re-prompted every run — this script has no update/fresh distinction,
+    # so re-running it (e.g. to add a destination, or just re-running it
+    # by habit) used to always mint a fresh/auto-generated password even
+    # for an already-existing repo. Confirmed live: that fresh password
+    # then fails to open the real repo at that path with "invalid
+    # repository password" — the repo's actual password was whatever got
+    # typed/generated the FIRST time, permanently, and nothing here ever
+    # read that back.
     echo ""
     log_info "Setting repository passwords (stored in backup.conf, chmod 600)..."
     for dn in "${DEST_NAMES_ARR[@]}"; do
         local pw=""
-        if [ "$UNATTENDED" = true ]; then
+        if [ -f "$CONF_FILE" ]; then
+            pw="$(grep "^DEST_${dn}_PASSWORD=" "$CONF_FILE" 2>/dev/null | sed -E "s/^DEST_${dn}_PASSWORD='(.*)'$/\1/")"
+        fi
+        if [ -n "$pw" ]; then
+            log_info "  Reusing existing password for '$dn' (from $CONF_FILE)."
+        elif [ "$UNATTENDED" = true ]; then
             pw="$(generate_password 32)"
         else
             read -rsp "  Password for '$dn' [Enter = auto-generate]: " pw; echo