media1: override ProtectHome for promtail to read kodi logs

The NixOS promtail module sets ProtectHome=true which blocks access
to /home entirely. Override to read-only so promtail can tail
/home/kodi/.kodi/temp/kodi.log.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hosts/media1/media-desktop.nix

@@ -102,6 +102,7 @@ in
 
   # Allow promtail to read kodi logs
   users.users.promtail.extraGroups = [ "kodi" ];
+  systemd.services.promtail.serviceConfig.ProtectHome = lib.mkForce "read-only";
 
   # Packages available on the system
   environment.systemPackages = [