fix(hosts/merope/calibre-web): make library read-only

calibre-web wrote metadata.db directly, which desynced calibre-server's
in-memory library cache: books uploaded through books.m7.rs stayed
invisible on the content server until it was restarted, and two writers
on one library risk clobbering each other's metadata.

Drop calibre-web from the readarr and calibre-server groups and force
ReadWritePaths down to its state directory, so the pre-existing
ProtectSystem=strict leaves the library read-only. The 0002 umask only
existed to keep those shared-library writes group-writable, so it goes
too. Readarr already writes through the content server API, so
calibre-server is now the sole writer.

Note that services.calibre-web.options.enableBookUploading does not
cover this on its own: config_uploading only drives the templates, while
POST /upload stays gated on the per-user ROLE_UPLOAD bit alone.

Assisted-by: pi (claude-opus-5)

hosts/nixos/merope/services/media/calibre-web.nix

@@ -4,9 +4,8 @@
   ...
 }: {
   users.users = {
-    # Allow calibre to write to readarr-managed library
+    # Allow calibre-server to write to readarr-managed library
     calibre-server.extraGroups = [config.services.readarr.group];
-    calibre-web.extraGroups = [config.services.calibre-server.group config.services.readarr.group];
   };
 
   services = {
@@ -43,7 +42,8 @@
     calibre-web.serviceConfig = {
       CPUWeight = 50;
       IOWeight = 50;
-      UMask = "0002";
+      ReadWritePaths = lib.mkForce ["/var/lib/calibre-web"];
+      ReadOnlyPaths = config.services.calibre-server.libraries;
     };
   };