fix(nexus): guard nexus.service with ConditionPathExists

A reboot before the first deploy would leave the enabled unit in failed
state; the condition keeps it inert until start.sh exists (same guard as
nexus-worker.service).

install/nexus-install.sh

@@ -122,6 +122,9 @@ cat >/etc/systemd/system/nexus.service <<EOF
 Description=nexus — Family Knowledge Hub
 After=network-online.target
 Wants=network-online.target
+# Skeleton-safe: only startable once the first deploy shipped the artifact
+# (otherwise a reboot before first deploy leaves the unit in failed state).
+ConditionPathExists=$CURRENT_DIR/start.sh
 
 [Service]
 Type=simple