Set explicit Kopia UI credentials for web login.

Use HTTP basic auth username kopia with KOPIA_REPOSITORY_PASSWORD; document in README.

stacks/backup/README.md

@@ -24,7 +24,7 @@ Kopia → Backblaze B2. Backs up `/config`, **selected** `labdata` paths (see `S
 
 ## After deploy
 
-- UI: `http://valhalla:51515` (or add `backup.ginnoir.com` internal-only in Caddy)
+- UI: https://backup.ginnoir.com (LAN/Tailscale) — username `kopia`, password = `KOPIA_REPOSITORY_PASSWORD` in `stack.env`
 - Subscribe phone to ntfy topic `backup` (or path in `NTFY_URL`)
 - **Restore test** (do once): pick a small dump from `/config/backup/dumps/`, restore to a throwaway container
 

stacks/backup/init-kopia.sh

@@ -44,4 +44,7 @@ else
   echo "init-kopia: B2 credentials empty — start UI only; configure repo manually (see README)"
 fi
 
-exec kopia server start --ui --insecure --address=0.0.0.0:51515
+# Web UI uses HTTP basic auth (distinct from repository encryption password).
+exec kopia server start --ui --insecure --address=0.0.0.0:51515 \
+  --server-username=kopia \
+  --server-password="${KOPIA_PASSWORD}"