fix: nostr-vpn service crash on reboot, detect activating state

- Remove ReadWritePaths sandbox (causes namespace error when /run/nostr-vpn
  doesn't exist after reboot — /run is tmpfs)
- Detect both 'active' and 'activating' states in VPN status check

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/vpn.rs

@@ -202,14 +202,15 @@ pub async fn get_status() -> VpnStatus {
 
 /// Check if NostrVPN system service is running and get its status.
 async fn get_nostr_vpn_status() -> Result<VpnStatus> {
-    // Check if nostr-vpn service is active
-    let active = tokio::process::Command::new("systemctl")
+    // Check if nostr-vpn service is active or activating
+    let output = tokio::process::Command::new("systemctl")
         .args(["is-active", "nostr-vpn"])
         .output()
         .await
-        .map(|o| o.status.success())
-        .unwrap_or(false);
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+        .unwrap_or_default();
 
+    let active = output == "active" || output == "activating";
     if !active {
         anyhow::bail!("nostr-vpn service not active");
     }