fix(viridian): resolve backup system initialization issues

Fix snapper and borgbackup jobs to work with ephemeral-btrfs setup:

Snapper fixes:
- Remove global /.snapshots mount (use nested subvolumes instead)
- Remove unused hostname variable
- Snapshots now stored in .snapshots subvolumes within each service

Borgbackup fixes:
- Add systemd.tmpfiles.rules to create staging directories at boot
- Add readWritePaths for staging directories (systemd sandboxing)
- Staging directories survive ephemeral root wipes

Architecture notes:
- Nested .snapshots subvolumes don't require separate mounts
- systemd tmpfiles ensures directories exist before services start
- ProtectSystem=strict requires explicit ReadWritePaths allowlist

nixos/viridian/services/borgbackup/offsite.nix

@@ -8,7 +8,15 @@
     rekeyFile = ./passphrase.age;
   };
 
+  # Create staging directory before borg service starts
+  systemd.tmpfiles.rules = [
+    "d /.staging-offsite 0755 root root -"
+  ];
+
   services.borgbackup.jobs."offsite" = {
+    # Allow writing to staging directory
+    readWritePaths = [ "/.staging-offsite" ];
+
     # Create staging snapshots before backup (independent from onsite)
     preHook = ''
       # Create read-only staging snapshots for each service

nixos/viridian/services/borgbackup/onsite.nix

@@ -15,7 +15,15 @@ in {
     ];
   };
 
+  # Create staging directory before borg service starts
+  systemd.tmpfiles.rules = [
+    "d /.staging-onsite 0755 root root -"
+  ];
+
   services.borgbackup.jobs."onsite" = {
+    # Allow writing to staging directory
+    readWritePaths = [ "/.staging-onsite" ];
+
     # Create staging snapshots before backup (independent from offsite)
     preHook = ''
       # Create read-only staging snapshots for each service