Harden the systemd unit + scope memlock to the mining user

[VijitSingh97]

Problem

systemd/xmrig.service.template runs User=root with LimitMEMLOCK=infinity and no hardening directives. Separately, configure_limits grants * soft/hard memlock unlimited to all users (rigforge.sh:499-500) — broader than needed.

Proposed

• Add the systemd hardening directives compatible with MSR/HugePages/cpupower needs (e.g. NoNewPrivileges where possible, ProtectHome, PrivateTmp, ProtectSystem with carve-outs); document precisely why any remaining privilege is required.
• Scope memlock unlimited to the dedicated mining user instead of *.
• Consider running XMRig as a dedicated non-root user with only the capabilities it needs (MSR write is the sticking point — document the tradeoff).

Acceptance

• Unit applies least-privilege hardening compatible with mining; rationale documented.
• memlock limit scoped to the mining user, not *.