fix(install): use ProtectHome=read-only for /home-rooted installs (#1685)

  bambuddy.service shipped with ProtectHome=true, which makes /home/* invisible
  to the service namespace. Installing into /home/bambuddy/ (instead of the
  default /opt/bambuddy/) made ExecStart=/home/bambuddy/venv/bin/uvicorn fail
  with status=203/EXEC because systemd couldn't resolve the binary path.
  ReadWritePaths=$INSTALL_PATH does not reliably re-expose /home/* subpaths for
  exec resolution.

  install/install.sh now detects /home/* INSTALL_PATH and emits ProtectHome=read-only;
  default /opt/bambuddy installs keep ProtectHome=true. The manual deploy template
  defaults to read-only with a comment on when to tighten it.

  read-only keeps /home immutable to the service - no security regression, since
  ReadWritePaths still gates writes to the install/data/log dirs only.

deploy/bambuddy.service

@@ -54,7 +54,10 @@ SyslogIdentifier=bambuddy
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
-ProtectHome=true
+# ProtectHome=true hides /home/* and breaks ExecStart when INSTALL_PATH is
+# under /home (issue #1685). Default is the safer read-only; flip to true if
+# your INSTALL_PATH is outside /home (e.g. /opt/bambuddy).
+ProtectHome=read-only
 ReadWritePaths=DATA_DIR LOG_DIR INSTALL_PATH
 
 [Install]

install/install.sh

@@ -519,6 +519,15 @@ create_systemd_service() {
 
     log_info "Creating systemd service..."
 
+    # ProtectHome=true hides /home/* from the service, which breaks ExecStart
+    # when INSTALL_PATH lives under /home (issue #1685). Loosen to read-only in
+    # that case so the venv binary is still resolvable; ReadWritePaths below
+    # re-grants writes for the install/data/log dirs.
+    local protect_home="true"
+    if [[ "$INSTALL_PATH" == /home/* ]]; then
+        protect_home="read-only"
+    fi
+
     cat > /tmp/bambuddy.service << EOF
 [Unit]
 Description=BamBuddy - Bambu Lab Print Management
@@ -552,7 +561,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
-ProtectHome=true
+ProtectHome=$protect_home
 ReadWritePaths=$DATA_DIR $LOG_DIR $INSTALL_PATH
 
 [Install]