feat: Phase 2 — systemd sandboxing, Bitcoin RPC localhost binding, Tailscale deprivilege

- Service runs as unprivileged `archipelago` user instead of root
- Added systemd sandboxing: ProtectSystem=strict, NoNewPrivileges, PrivateTmp,
  MemoryDenyWriteExecute, RestrictNamespaces, SystemCallFilter
- Bitcoin RPC rpcallowip restricted to localhost + Podman subnet (10.88.0.0/16)
- Tailscale container: removed --privileged, uses cap-drop ALL + cap-add NET_ADMIN/NET_RAW

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -5,7 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=notify
-User=root
+User=archipelago
 Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
 Environment="ARCHIPELAGO_DEV_MODE=true"
 ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk "{print $$1}")" > /etc/archipelago/host-ip.env'
@@ -15,5 +15,35 @@ RestartSec=5
 WatchdogSec=300
 TimeoutStartSec=300
 
+# Filesystem protection
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/var/lib/archipelago
+
+# Privilege restriction
+NoNewPrivileges=yes
+PrivateDevices=yes
+
+# Network restriction (allow only IPv4/IPv6 + Unix sockets)
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+# Restrict what the process can do
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+
+# Only allow needed syscalls
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+
+# Memory protection
+MemoryDenyWriteExecute=yes
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+
 [Install]
 WantedBy=multi-user.target