An installer that had only ever met Arch

`deploy/lxc-install.sh` had never been executed -- there was no Proxmox host
to run it on, and PLAN.md said so rather than letting it read as tested. It
was reviewed and `bash -n` checked, which is not the same claim. Running it
for the first time found two Arch-isms in `install.sh`, the script it wraps,
and only a Debian machine could have found either.

`python -m venv` is the one that mattered. On Arch `python` is Python 3, so
the bare name had worked on the only machine this had ever run on. Debian has
no `python` at all unless somebody installed `python-is-python3`, and the LXC
bootstrap installs `python3` -- so the install aborted at the virtualenv step,
with the service user, the bind mount and the clone already in place. It is
`python3` now, which is right on both.

`--shell /usr/bin/nologin` is the one that did not. That is where Arch keeps
nologin and not where Debian does, but nothing ever invoked it: `sudo -u`
execs the command directly and systemd's `User=` never reads a shell. The
account worked while pointing at a file that was not there. `/usr/sbin/nologin`
is correct on Debian and resolves on Arch too, whose `/usr/sbin` is a symlink
to `bin`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/install.sh

@@ -95,9 +95,13 @@ fi
 echo "== service user =="
 # --system: no ageing, no mail spool. Home under /home, not /var/lib, so the
 # venv and database sit on the larger volume.
+#
+# `/usr/sbin/nologin` is Debian's path and works on both: Arch keeps `nologin`
+# in /usr/bin, but its /usr/sbin is a symlink to bin, so the Debian spelling
+# resolves there while the Arch one does not resolve on Debian at all.
 if ! getent passwd "$SERVICE_USER" >/dev/null; then
   sudo useradd --system --create-home --home-dir "$HOME_DIR" \
-       --shell /usr/bin/nologin --comment "LLeMbas" "$SERVICE_USER"
+       --shell /usr/sbin/nologin --comment "LLeMbas" "$SERVICE_USER"
 else
   echo "   user $SERVICE_USER already exists"
 fi
@@ -120,8 +124,13 @@ else
 fi
 
 echo "== virtualenv =="
+# `python3`, not `python`. On Arch -- the machine this was written on and the
+# only one it had ever run on -- `python` is Python 3 and the bare name worked.
+# On Debian it does not exist unless somebody installed `python-is-python3`, so
+# the LXC bootstrap aborted here, after the service user, the bind mount and the
+# clone were already in place. `python3` is correct on both.
 if [[ ! -x "$VENV/bin/python" ]]; then
-  sudo -u "$SERVICE_USER" python -m venv "$VENV"
+  sudo -u "$SERVICE_USER" python3 -m venv "$VENV"
 fi
 sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
 # The extras a deployment gets. `search` because DuckDuckGo is the default web