fix(bootstrap): fail the nano install when the unit does not stay up

install_nano_service printed "enabled and started" straight after
systemctl restart, which returns as soon as the process is forked. An
upgrade that keeps an old felis.toml the new binary rejects (an
[[auth_source]] without a prefix, say) left the unit crash-looping in
auto-restart while the installer reported success, and every login
through the proxy failed.

The install now waits two seconds and asks systemctl is-active. A unit
that exited is in "activating (auto-restart)", which is-active does not
count as active; on real systemd a unit whose process exits 1 under
Restart=on-failure reads activating/auto-restart and is-active returns
non-zero, while a running one reads active/running and returns 0. On
failure the install prints the unit's last 20 journal lines and stops.
This also surfaces a nano unit locked out of an existing 0700 /etc/felis.

The harness runs the extracted function with systemctl stubbed both
ways. Without the check, the dead-unit cases fail.

deploy/bootstrap.sh

@@ -2379,6 +2379,13 @@ EOF
   # restart, not `enable --now`: on a re-run the service is already active and --now would
   # leave the OLD binary running against the NEW unit. Converge means converge.
   systemctl restart felis-nano
+  # restart returns as soon as the process is forked. A config the new binary rejects, or a
+  # file it cannot open, only shows once it has exited and the unit sits in auto-restart.
+  sleep 2
+  if ! systemctl is-active --quiet felis-nano; then
+    journalctl -u felis-nano -n 20 --no-pager || true
+    die "felis-nano did not stay up; its last log lines are above"
+  fi
   ok "felis-nano.service enabled and started (listen ${FELIS_NANO_LISTEN})"
 }