Add sqlite write permission check and preStart chown

- newSqliteStore now checks directory writability before opening
- Immediate SELECT 1 ping catches readonly DB early
- Systemd preStart chown ensures db file ownership is correct
- Fixes: SQLITE_READONLY_CANTINIT (1032)

flake.nix

@@ -122,6 +122,12 @@
               wantedBy = [ "multi-user.target" ];
               after = [ "network.target" ];
 
+              preStart = ''
+                if [ -f "${builtins.toString cfg.sqlitePath}" ]; then
+                  chown st-pierre:st-pierre "${builtins.toString cfg.sqlitePath}"
+                fi
+              '';
+
               serviceConfig = {
                 User = "st-pierre";
                 Group = "st-pierre";