fix: address code review — restrict ReadOnlyPaths to unlock-password, clarify amount error message

ReadOnlyPaths for nwc-lnurl.service now lists only the specific file
/var/lib/albyhub/unlock-password (least-privilege) instead of the
whole /var/lib/albyhub directory.

Amount-duplicate error message changed to "A single amount parameter is
required" (clearer for 2+ values than "Exactly one").

Test assertion updated to match new message text.

app/sovran_systemsos_web/nwc_lnurl_service.py

@@ -194,7 +194,7 @@ def _make_handler(manager: "AlbyHubManager") -> type:
                         400,
                         {
                             "status": "ERROR",
-                            "reason": "Exactly one amount parameter is required",
+                            "reason": "A single amount parameter is required",
                         },
                     )
                     return

app/tests/test_wallet_connections.py

@@ -1046,7 +1046,7 @@ class LnurlHandlerAmountTests(unittest.TestCase):
         code, body = sent[0]
         self.assertEqual(code, 400)
         self.assertEqual(body["status"], "ERROR")
-        self.assertIn("Exactly one", body["reason"])
+        self.assertIn("single amount", body["reason"])
 
     def test_three_amount_values_returns_400(self):
         sent = self._run_handler("/lnurlp/alice/callback?amount=1000&amount=2000&amount=3000")

modules/nwc-wallets.nix

@@ -125,7 +125,7 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       ProtectSystem = "strict";
       ReadOnlyPaths = [
         "/var/lib/domains/lightning"
-        "/var/lib/albyhub"
+        "/var/lib/albyhub/unlock-password"
       ];
     };
   };