fix: address code review — restrict ReadOnlyPaths to unlock-password, clarify amount error message

ReadOnlyPaths for nwc-lnurl.service now lists only the specific file
/var/lib/albyhub/unlock-password (least-privilege) instead of the
whole /var/lib/albyhub directory.

Amount-duplicate error message changed to "A single amount parameter is
required" (clearer for 2+ values than "Exactly one").

Test assertion updated to match new message text.

modules/nwc-wallets.nix

@@ -125,7 +125,7 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       ProtectSystem = "strict";
       ReadOnlyPaths = [
         "/var/lib/domains/lightning"
-        "/var/lib/albyhub"
+        "/var/lib/albyhub/unlock-password"
       ];
     };
   };