fix: resolve final PR #337 blockers — credential access, amount validation, wording

Blocker 1: run nwc-lnurl.service as albyhub user/group so it can read
/var/lib/albyhub/unlock-password (mode 0600, dir mode 0700).
Remove the now-unused nwc-lnurl user, group, and /var/lib/nwc-lnurl
state directory.  ReadOnlyPaths updated to allow the whole albyhub dir.

Blocker 2: require exactly one amount query parameter in the LNURL
callback HTTP handler.  Duplicate values now return a 400 protocol
error ("Exactly one amount parameter is required") before the helper is
called.  The missing-amount and non-integer paths are unchanged.

Blocker 3: partial-funding failure message now reads "was created
successfully" instead of "already exists" to avoid confusion with a
duplicate-name error, while retaining the warning not to recreate.

Tests added:
- LnurlHandlerAmountTests — HTTP-handler level tests for duplicate (2×,
  3×), single-valid, and missing amount parameters.
- test_create_partial_failure_message_says_created_successfully —
  asserts exact wording of the partial-funding message.
- test_nwc_lnurl_service_runs_as_albyhub — asserts the Nix service block
  sets User/Group to albyhub.
- test_nwc_module_no_separate_nwc_lnurl_user — asserts no standalone
  nwc-lnurl user/group is declared.

All 229 Python tests pass (1 skipped).  JS syntax clean.  No secrets.

app/sovran_systemsos_web/nwc_hub_manager.py

@@ -505,7 +505,7 @@ class AlbyHubManager:
             except AlbyHubError as exc:
                 funding_result["error"] = exc.code
                 funding_result["message"] = (
-                    "The wallet already exists and the NWC connection secret is shown "
+                    "The wallet was created successfully and the NWC connection secret is shown "
                     "above, but initial funding failed. Save the NWC secret now. "
                     "Do not recreate this wallet."
                 )