Open WebUI backup contract backs up symlink instead of private state directory

[dniku]

Open WebUI backup contract backs up /var/lib/open-webui, but on NixOS this is a symlink to /var/lib/private/open-webui because the service uses DynamicUser/StateDirectory.

Restic does not follow symlinked directories during backup, so the default SHB backup request can produce a successful snapshot with 0 files instead of backing up Open WebUI state.

Workaround:

request = config.shb.open-webui.backup.request // {
  user = "root";
  sourceDirectories = [ "/var/lib/private/open-webui" ];
};

This is needed because backing up /var/lib/private/open-webui directly is not accessible to the default open-webui backup user.