fix: resolve final PR #337 blockers — credential access, amount validation, wording

Blocker 1: run nwc-lnurl.service as albyhub user/group so it can read
/var/lib/albyhub/unlock-password (mode 0600, dir mode 0700).
Remove the now-unused nwc-lnurl user, group, and /var/lib/nwc-lnurl
state directory.  ReadOnlyPaths updated to allow the whole albyhub dir.

Blocker 2: require exactly one amount query parameter in the LNURL
callback HTTP handler.  Duplicate values now return a 400 protocol
error ("Exactly one amount parameter is required") before the helper is
called.  The missing-amount and non-integer paths are unchanged.

Blocker 3: partial-funding failure message now reads "was created
successfully" instead of "already exists" to avoid confusion with a
duplicate-name error, while retaining the warning not to recreate.

Tests added:
- LnurlHandlerAmountTests — HTTP-handler level tests for duplicate (2×,
  3×), single-valid, and missing amount parameters.
- test_create_partial_failure_message_says_created_successfully —
  asserts exact wording of the partial-funding message.
- test_nwc_lnurl_service_runs_as_albyhub — asserts the Nix service block
  sets User/Group to albyhub.
- test_nwc_module_no_separate_nwc_lnurl_user — asserts no standalone
  nwc-lnurl user/group is declared.

All 229 Python tests pass (1 skipped).  JS syntax clean.  No secrets.

modules/nwc-wallets.nix

@@ -44,18 +44,8 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
     extraGroups = [ ];
   };
 
-  users.groups.nwc-lnurl = { };
-  users.users.nwc-lnurl = {
-    isSystemUser = true;
-    group = "nwc-lnurl";
-    home = "/var/lib/nwc-lnurl";
-    createHome = false;
-    extraGroups = [ "albyhub" ];
-  };
-
   systemd.tmpfiles.rules = [
     "d /var/lib/albyhub       0700 albyhub albyhub -"
-    "d /var/lib/nwc-lnurl     0750 nwc-lnurl nwc-lnurl -"
   ];
 
   services.lnd.macaroons.albyhub = {
@@ -123,8 +113,8 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
 
     serviceConfig = {
       Type = "simple";
-      User = "nwc-lnurl";
-      Group = "nwc-lnurl";
+      User = "albyhub";
+      Group = "albyhub";
       ExecStart = "${config.services.sovranHub.webPackage}/bin/nwc-lnurl";
       Restart = "on-failure";
       RestartSec = "10s";
@@ -135,7 +125,7 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       ProtectSystem = "strict";
       ReadOnlyPaths = [
         "/var/lib/domains/lightning"
-        "/var/lib/albyhub/unlock-password"
+        "/var/lib/albyhub"
       ];
     };
   };