Fix capability binding with NoNewPrivileges using AmbientCapabilities

- Add AmbientCapabilities=CAP_NET_BIND_SERVICE to systemd service
- Add CapabilityBoundingSet=CAP_NET_BIND_SERVICE
- Fixes "permission denied" on ports 22/80/443
- NoNewPrivileges=true blocks file capabilities, but AmbientCapabilities works

This grants the capability through systemd instead of relying on
file capabilities, which is compatible with NoNewPrivileges.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: baocin

deploy/install.sh

@@ -112,6 +112,8 @@ After=network.target
 Type=simple
 User=gitvet
 Group=gitvet
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 WorkingDirectory=/opt/gitvet
 Environment="PATH=/usr/local/bin:/usr/bin:/bin"
 Environment="XDG_CACHE_HOME=/var/lib/gitvet/cache"

deploy/update.sh

@@ -197,6 +197,8 @@ After=network.target
 Type=simple
 User=gitvet
 Group=gitvet
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 WorkingDirectory=/opt/gitvet
 Environment="PATH=/usr/local/bin:/usr/bin:/bin"
 Environment="XDG_CACHE_HOME=/var/lib/gitvet/cache"