Encrypt borg repos with repokey-blake2 + shared passphrase

borg_passphrase is required (Semaphore secret, same across hosts).
The role writes it to /etc/borgmatic/passphrase (0600 root) and
configures borgmatic to use BORG_PASSCOMMAND=cat /etc/borgmatic/passphrase,
and runs `borg init --encryption=repokey-blake2` with BORG_PASSPHRASE in
the env. no_log on the tasks that touch the passphrase.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/backup/tasks/borgcontroller.yml

@@ -120,9 +120,12 @@
 
 - name: Initialize borg repository (no-op if already initialized)
   ansible.builtin.command:
-    cmd: borg init --encryption=none {{ borgcontroller_repo_uri }}
+    cmd: borg init --encryption=repokey-blake2 {{ borgcontroller_repo_uri }}
+  environment:
+    BORG_PASSPHRASE: "{{ borg_passphrase }}"
   register: _borg_init
   changed_when: _borg_init.rc == 0
   failed_when:
     - _borg_init.rc != 0
     - "'already exists' not in (_borg_init.stderr | default(''))"
+  no_log: true