Update interface names because usePredictableInterfaceNames is now off

tinyproxy binds to the bridge IP but had no ordering dependency on
systemd-networkd, so it could start before the bridge existed.

common/network/pia-vpn/default.nix

@@ -234,9 +234,6 @@ in
       before = [ "container@pia-vpn.service" ];
       after = [ "systemd-networkd.service" ];
       requires = [ "systemd-networkd.service" ];
-      serviceConfig.ExecStartPre = [
-        "+${pkgs.systemd}/lib/systemd/systemd-networkd-wait-online --interface=${cfg.bridgeName}:no-carrier --timeout=60"
-      ];
     };
 
     # WireGuard interface creation (host-side oneshot)

machines/storage/s0/default.nix

@@ -341,8 +341,7 @@
     enable = true;
     settings.MEMOS_PORT = "57643";
   };
-  # ReadWritePaths doesn't work with ProtectSystem=strict on ZFS submounts (/var/lib is a separate dataset)
-  systemd.services.memos.serviceConfig.ProtectSystem = lib.mkForce "full";
+  systemd.services.memos.serviceConfig.PrivateUsers = lib.mkForce false;
 
   services.outline = {
     enable = true;