docs(app): fill service: block — systemd-user, Restart=always, LAN-reachable

membershipd now ships as a systemd user service (unit unibus-membershipd.service,
restart_policy always, runtime systemd-user). is_local_only flips to false since
--bind 0.0.0.0 makes both planes LAN-reachable. fn doctor services-spec: OK, no
drift.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app.md

@@ -22,13 +22,13 @@ service:
   port: 8470
   health_endpoint: /healthz
   health_timeout_s: 3
-  systemd_unit: null
-  systemd_scope: null
-  restart_policy: none
-  runtime: manual
+  systemd_unit: unibus-membershipd.service
+  systemd_scope: user
+  restart_policy: always
+  runtime: systemd-user
   pc_targets:
     - lucas-linux
-  is_local_only: true
+  is_local_only: false
 e2e_checks:
   - id: build
     cmd: "CGO_ENABLED=0 go build ./..."