feat(copyparty): add read-only root volume

configs/nixos/AGENTS.md

@@ -46,6 +46,10 @@
 - `sops.secrets.<name>.owner` must name a user known on the decrypting host.
   Do not set the owner to a guest-only service user unless the host also declares that user.
   Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
+- A read-only guest bind mount cannot contain nested writable bind mounts unless their mount-point
+  directories already exist inside the read-only source.
+  For aggregate Copyparty volumes such as `/srv` with nested `/srv/inbox`, keep the guest bind mount
+  writable and enforce read-only behavior through Copyparty access plus service `ReadWritePaths`.
 - Pikachu deploys from the monorepo checkout copied to `~/dev`.
   Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.
 - Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.