fix(yami): use services.gitea.lfs.enable instead of raw LFS_START_SERVER

Raw LFS_START_SERVER made gitea try to generate and persist LFS_JWT_SECRET
into app.ini, which NixOS intentionally keeps read-only. The lfs.enable
helper lets the module own the secret and wire it in correctly.

yami-dev-stack.nix

@@ -48,6 +48,10 @@ in
       enable   = true;
       appName  = "Yami Git";
 
+      # LFS enabled via the NixOS helper so the module manages LFS_JWT_SECRET
+      # (writing it to app.ini, which is read-only by design).
+      lfs.enable = true;
+
       database = {
         type   = "postgres";
         socket = "/run/postgresql";
@@ -63,7 +67,6 @@ in
           HTTP_PORT        = 3000;
           SSH_PORT         = 2222;
           START_SSH_SERVER = true;
-          LFS_START_SERVER = true;
         };
 
         service = {