The services.lnd.macaroons submodule has no 'enable' option — macaroons are implicitly enabled by being defined. Replace 'enable = true' with 'user = cfg.btcpayserver.user' which is the correct option for controlling macaroon file ownership.