fix: address code review — restrict ReadOnlyPaths to unlock-password, clarify amount error message

ReadOnlyPaths for nwc-lnurl.service now lists only the specific file
/var/lib/albyhub/unlock-password (least-privilege) instead of the
whole /var/lib/albyhub directory.

Amount-duplicate error message changed to "A single amount parameter is
required" (clearer for 2+ values than "Exactly one").

Test assertion updated to match new message text.

app/sovran_systemsos_web/nwc_lnurl_service.py

@@ -194,7 +194,7 @@ def _make_handler(manager: "AlbyHubManager") -> type:
                         400,
                         {
                             "status": "ERROR",
-                            "reason": "Exactly one amount parameter is required",
+                            "reason": "A single amount parameter is required",
                         },
                     )
                     return