railiance-backup: remove the hardcoded Nextcloud token

Read NC_WEBDAV_TOKEN/NC_WEBDAV_URL from the environment or the governed
OpenBao lane (platform/workloads/railiance/backup/offsite-lane), as
railiance-cluster's copy has since 2026-07-07; refuse without credentials.
The removed value is the RPF-WP-0029 predecessor share token, attested
unshared 2026-09-15 (ORGREF-WP-0002-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

tools/cmd/railiance-backup

@@ -7,8 +7,21 @@ source "${ROOT}/lib/railiance-print.sh"
 
 # ── Configuration ─────────────────────────────────────────────────────────────
 AGE_PUBLIC_KEY="age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz"
-NC_WEBDAV_URL="https://nx4069.your-storageshare.de/public.php/webdav"
-NC_TOKEN="MfTBEjcJTGS8Ywo"
+BAO_PATH="platform/workloads/railiance/backup/offsite-lane"
+NC_WEBDAV_URL="${RAILIANCE_BACKUP_NC_WEBDAV_URL:-}"
+NC_TOKEN="${RAILIANCE_BACKUP_NC_TOKEN:-}"
+
+if [[ -z "${NC_TOKEN}" || -z "${NC_WEBDAV_URL}" ]] && command -v bao >/dev/null 2>&1; then
+  if bao kv metadata get "${BAO_PATH}" >/dev/null 2>&1; then
+    NC_TOKEN="$(bao kv get -field=NC_WEBDAV_TOKEN "${BAO_PATH}")"
+    NC_WEBDAV_URL="$(bao kv get -field=NC_WEBDAV_URL "${BAO_PATH}")"
+  fi
+fi
+: "${NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/dav/filesdrop/${NC_TOKEN}}"
+if [[ -z "${NC_TOKEN}" ]]; then
+  bad "credentials" "set RAILIANCE_BACKUP_NC_TOKEN or: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read"
+  exit 1
+fi
 PG_CONTAINER="infra-postgres-1"
 PG_USER="custodian"
 PG_DB="custodian"