Grant CAP_SYS_RAWIO for NeoPixel DMA access without root

The rpi_ws281x library needs /dev/mem access for DMA-based LED control.
Add AmbientCapabilities=CAP_SYS_RAWIO and kmem group to the service
file so it works without running the whole service as root.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dune-weaver.service

@@ -11,7 +11,8 @@ Restart=always
 RestartSec=5
 Environment=PYTHONUNBUFFERED=1
 CPUAffinity=0 1 2
-SupplementaryGroups=dialout gpio
+SupplementaryGroups=dialout gpio kmem
+AmbientCapabilities=CAP_SYS_RAWIO
 
 [Install]
 WantedBy=multi-user.target