master
restic: refactor to use lib/http
tree-wide: replace /bin/bash with /usr/bin/env bash
serve restic: fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING
serve restic: add serve rc interface
serve restic: fix --private-repos isolation bypass CVE-2026-59733
build: update to go1.19 and make go1.17 the minimum required version