feat(idols-ai): back up the dsh state directory (~/.dsh) with restic

dsh keeps its session transcripts, workspace storages, and profiles in
DSH_HOME=~/.dsh, which was outside the backup allowlist. Exclude its
.credentials.yaml like the module's other credential paths.

hosts/idols-ai/restic.nix

@@ -28,6 +28,9 @@
       "/home/ryan/src"
       "/home/ryan/nix-config"
       "/home/ryan/.local/state"
+      # dsh (DeepSeek Harness) state: session transcripts, workspace storages,
+      # profiles. Its credentials file is excluded below.
+      "/home/ryan/.dsh"
     ];
 
     # anything bigger than this is a re-downloadable artifact (models, datasets,
@@ -79,6 +82,8 @@
       "**/.cache"
       # git object packs: re-fetchable from the remotes
       "**/.git/objects/pack"
+      # dsh login credentials, same rule as the module's built-in credential excludes
+      "**/.dsh/.credentials.yaml"
     ];
   };
 }