fix(youko): apply /data tmpfiles in a pass of their own

89d7a9bd made systemd-tmpfiles-setup RequiresMountsFor the five nofail
USB-disk mounts. One failed mount then skipped every tmpfiles rule on the
host, and sysinit.target waited for the disks and the LUKS unlock even on
success.

Leave the boot-wide pass as upstream ships it and add data-tmpfiles:
`systemd-tmpfiles --prefix=/data` with WantsMountsFor on the /data mounts,
ordered before the services that use them.

Assisted-by: Claude Code (claude-opus-5-5)

hosts/12kingdoms-youko/homelab-services/data-tmpfiles.nix

@@ -0,0 +1,30 @@
+{ config, lib, ... }:
+let
+  consumers = map (n: "${n}.service") [
+    "immich-server"
+    "jellyfin"
+    "nginx"
+    "restic-backups-homelab"
+    "restic-rest-server"
+    "restic-server-snapshot"
+    "rustfs"
+    "sftpgo"
+    "transmission"
+  ];
+in
+{
+  # The nofail /data mounts can finish after systemd-tmpfiles-setup, so apply
+  # the /data rules again once they are mounted.
+  systemd.services.data-tmpfiles = {
+    description = "Create tmpfiles.d entries on the /data mounts";
+    wantedBy = [ "multi-user.target" ] ++ consumers;
+    before = consumers;
+    unitConfig.WantsMountsFor = lib.filter (lib.hasPrefix "/data/") (lib.attrNames config.fileSystems);
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${config.systemd.package}/bin/systemd-tmpfiles --create --remove --boot --prefix=/data";
+      SuccessExitStatus = "DATAERR CANTCREAT";
+    };
+  };
+}

hosts/12kingdoms-youko/homelab-services/disko-fs.nix

@@ -33,18 +33,6 @@ in
 
   fileSystems."/data/fileshare/public".depends = [ "/data/fileshare" ];
 
-  # The nofail data mounts finish after local-fs.target. systemd-tmpfiles-setup
-  # only orders itself after local-fs.target, so without an explicit dependency
-  # it can run while /data is still the read-only fallback tmpfs and fail to
-  # create the Transmission, Immich, RustFS and restic directories at boot.
-  systemd.services.systemd-tmpfiles-setup.unitConfig.RequiresMountsFor = [
-    "/data/apps"
-    "/data/fileshare"
-    "/data/fileshare/public"
-    "/data/backups"
-    "/data/apps-snapshots"
-  ];
-
   # By adding this crypttab entry, the disk will be unlocked by systemd-cryptsetup@xxx.service at boot time.
   # This systemd service is running after agenix, so that the keyfile is already available.
   environment.etc = {