nrec-nixos01: use lfs.enable instead of raw setting

The NixOS module's lfs.enable option properly handles LFS JWT secret
generation via forgejo-secrets.service, fixing the permission denied
error on app.ini.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/forgejo/default.nix

@@ -3,6 +3,7 @@
   services.forgejo = {
     enable = true;
     database.type = "sqlite3";
+    lfs.enable = true;
     settings = {
       server = {
         DOMAIN = "nrec-nixos01.t-juice.club";
@@ -10,7 +11,6 @@
         HTTP_ADDR = "127.0.0.1";
         HTTP_PORT = 3000;
       };
-      server.LFS_START_SERVER = true;
       service.DISABLE_REGISTRATION = true;
       "service.explore".REQUIRE_SIGNIN_VIEW = true;
       session.COOKIE_SECURE = true;