Fix memos failing to open SQLite database on ZFS

ProtectSystem=strict with ReadWritePaths fails silently on ZFS submounts
(/var/lib is a separate dataset), leaving the data dir read-only. Downgrade
to ProtectSystem=full which leaves /var writable while still protecting
/usr and /boot.

common/network/pia-vpn/default.nix

@@ -234,6 +234,9 @@ in
       before = [ "container@pia-vpn.service" ];
       after = [ "systemd-networkd.service" ];
       requires = [ "systemd-networkd.service" ];
+      serviceConfig.ExecStartPre = [
+        "+${pkgs.systemd}/lib/systemd/systemd-networkd-wait-online --interface=${cfg.bridgeName}:no-carrier --timeout=60"
+      ];
     };
 
     # WireGuard interface creation (host-side oneshot)

machines/storage/s0/default.nix

@@ -341,7 +341,8 @@
     enable = true;
     settings.MEMOS_PORT = "57643";
   };
-  systemd.services.memos.serviceConfig.PrivateUsers = lib.mkForce false;
+  # ReadWritePaths doesn't work with ProtectSystem=strict on ZFS submounts (/var/lib is a separate dataset)
+  systemd.services.memos.serviceConfig.ProtectSystem = lib.mkForce "full";
 
   services.outline = {
     enable = true;