iso: ship restic for Settings home backup

Snapper remains root (@) only. Home backup is Settings → Backup
(restic). Document that split in the README.

README.md

@@ -46,9 +46,11 @@ wiring up dotfiles, no per-tool bakery installs.
   Mesa only — **NVIDIA proprietary drivers are not included** and NVIDIA is
   unsupported out of the box (see [docs/hardware.md](docs/hardware.md)).
 - **Resilience**: btrfs + snapper + snap-pac + grub-btrfs snapshots on every
-  pacman transaction; zram swap; ufw firewall (deny-incoming, mDNS allowed).
+  pacman transaction (**root `@` only** — snapper does not cover `@home`);
-  A/B root swapping is **not** implemented. Recovery is a grub-btrfs reboot,
+  home backup is **Settings → Backup** (restic, local path or SFTP); zram
-  not `snapper rollback` (GRUB pins `rootflags=subvol=@`). See
+  swap; ufw firewall (deny-incoming, mDNS allowed). A/B root swapping is
+  **not** implemented. Recovery is a grub-btrfs reboot, not
+  `snapper rollback` (GRUB pins `rootflags=subvol=@`). See
   [docs/hardware.md](docs/hardware.md).
 - **Security**: optional full-disk encryption is **LUKS1** (GRUB cannot unlock
   LUKS2 + Argon2id). Secure Boot is **self-signed Setup Mode only** via
@@ -264,7 +266,8 @@ also get live systemd status + Start/Stop/Restart/Logs.
 | Packages | `bakery` installed list + updates, pacman system update |
 | AUR | Search via `yay`; installing opens a terminal (AUR build scripts need review) |
 | Firmware | `fwupd` device list + updates |
-| Snapshots | `snapper` list / boot-into (grub-btrfs) / delete |
+| Snapshots | `snapper` list / boot-into (grub-btrfs) / delete — **root (`@`) only** |
+| Backup | restic of `$HOME` (`@home`) via Settings → Backup; snapper does not cover home |
 
 Source and build live in the [bos-settings](https://git.breadway.dev/Breadway/bos-settings)
 repo, not here.
@@ -384,7 +387,9 @@ until `dl.breadway.dev/arch` exists).
 
 **An update broke something (system still boots):** open BOS Settings →
 Snapshots and pick a snapshot to boot, **or** choose one from the **GRUB
-“snapshots” submenu** (grub-btrfs) at boot, then reboot into it.
+“snapshots” submenu** (grub-btrfs) at boot, then reboot into it. Snapper
+is root only. Home files are **Settings → Backup** (restic restore into
+`~/bos-restore-<id>`, not over `$HOME`).
 
 Do **not** run `snapper rollback` as the default recovery step. BOS GRUB
 pins `rootflags=subvol=@`, so a snapper-swapped default subvolume is not

iso/packages.x86_64

@@ -78,6 +78,8 @@ snapper
 snap-pac
 grub-btrfs
 inotify-tools
+# Home backup (Settings → Backup). Snapper is root (`@`) only; restic covers $HOME.
+restic
 
 # Wayland / Hyprland
 hyprland