nix: harden custom data directory ownership

[fosskar]

Summary

• preserve systemd StateDirectory=ssync for the default data path
• create custom services.ssync.dataDir paths as mode 0700 for the configured user and grant only that path through ReadWritePaths
• keep external age identity, node key, and cluster artifact paths pre-provisioned and read-only
• verify normalized hardening properties across NixOS and Home Manager renderers
• bump ssync to 0.19.2

Security and performance

• custom storage no longer depends on an undeclared writable path outside the sandbox
• external secret parents are never added to the writable allow-list
• daemon hot paths are unchanged; all added work happens during Nix evaluation, activation, or tests

Verification

• nix build .#checks.x86_64-linux.vm-module
• nix build .#checks.x86_64-linux.module-contract
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (235 tests across 13 suites)
• nix fmt -- --ci