fix(nix): use separate setup service to create dataDir before namespace setup

The main service uses ReadWritePaths for security hardening, but systemd
requires these paths to exist BEFORE setting up the mount namespace.
ExecStartPre runs AFTER namespace setup, so it cannot create the directories.

This fix adds a separate oneshot setup service (ngit-grasp-{name}-setup)
that:
- Runs before the main service without namespace restrictions
- Creates dataDir and subdirectories (git/, relay/) with mkdir -p
- Sets proper ownership (user:group) and permissions (750)
- Uses RemainAfterExit so it only runs once per boot

The main service now depends on the setup service via requires/after.

Fixes: 'Failed to set up mount namespacing: /path: No such file or directory'

0 files changed, 0 insertions, 0 deletions