Raw LFS_START_SERVER made gitea try to generate and persist LFS_JWT_SECRET into app.ini, which NixOS intentionally keeps read-only. The lfs.enable helper lets the module own the secret and wire it in correctly.
https://claude.ai/code/session_017dm8ypaaWNeA27ctmwq5dn