nixos/tinc: chown the network state directory itself

The preStart chowned `hosts/` and `invitations/` to `tinc-<network>`
but left `/etc/tinc/<network>/` itself owned by root (or a stale UID
after a `tinc-<network>` UID reassignment). Fine while tinc 1.0 only
read config there, but tinc 1.1+ and tincr write a per-peer address
bootstrap cache into the network directory, so the daemon needs to
write it. When it can't, the save fails (tincr logs "Permission
denied", tinc 1.1pre18 swallows it), the cache stays empty and
reconnects fall back to DNS instead of the last-known IP.

Chown the network directory alongside hosts/ and invitations/. Use a
single `install -d` so existing directories with a stale owner get
fixed too, which plain `mkdir -p` would skip.

Assisted-by: Claude Code (claude-opus-4-7)

nixos/modules/services/networking/tinc.nix

@@ -421,10 +421,7 @@ in
               ExecStart = "${data.package}/bin/tincd -D -U tinc-${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}";
             };
             preStart = ''
-              mkdir -p /etc/tinc/${network}/hosts
-              chown tinc-${network} /etc/tinc/${network}/hosts
-              mkdir -p /etc/tinc/${network}/invitations
-              chown tinc-${network} /etc/tinc/${network}/invitations
+              install -d -o tinc-${network} /etc/tinc/${network} /etc/tinc/${network}/hosts /etc/tinc/${network}/invitations
 
               # Determine how we should generate our keys
               if type tinc >/dev/null 2>&1; then