fix: nostr-vpn service — set HOME, create dirs, remove strict sandbox

nvpn binary writes to $HOME/.config/nvpn. Set HOME to data dir,
create runtime dirs in ExecStartPre, remove overly restrictive
ProtectSystem/ProtectHome that blocked the binary.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/nostr-vpn.service

@@ -6,7 +6,9 @@ Wants=network-online.target
 [Service]
 Type=simple
 User=root
+Environment=HOME=/var/lib/archipelago/nostr-vpn
 EnvironmentFile=-/var/lib/archipelago/nostr-vpn/env
+ExecStartPre=+/bin/bash -c 'mkdir -p /run/nostr-vpn /var/lib/archipelago/nostr-vpn/.config/nvpn'
 ExecStartPre=/bin/bash -c 'test -f /var/lib/archipelago/nostr-vpn/env || { echo "NostrVPN not configured — waiting for onboarding"; exit 1; }'
 ExecStart=/usr/local/bin/nvpn daemon
 Restart=on-failure
@@ -14,18 +16,9 @@ RestartSec=10
 TimeoutStartSec=30
 TimeoutStopSec=10
 
-# Networking capabilities (required for TUN/WireGuard)
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
-
-# Security hardening
-NoNewPrivileges=yes
-ProtectSystem=strict
-ReadWritePaths=/var/lib/archipelago/nostr-vpn /run/nostr-vpn /dev/net/tun
-ProtectHome=yes
-PrivateTmp=yes
+# Security — runs as root for TUN/WireGuard access
+ReadWritePaths=/var/lib/archipelago/nostr-vpn /run/nostr-vpn
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictRealtime=yes
 
 # Resource limits
 MemoryMax=256M