systemd unit as every room's: ubuntu, /opt/openvibe.bench, hardening and drain

ddiff --git a/deploy/systemd/openvibe-bench.service b/deploy/systemd/openvibe-bench.service
iindex 3178c3d..846db89 100644
---- a/deploy/systemd/openvibe-bench.service
++++ b/deploy/systemd/openvibe-bench.service
@@@ -1,15 +1,31 @@
  [Unit]
--Description=OpenVibe.Bench — the shared AI benchmark engine
--After=network.target
++Description=OpenVibe.Bench — one AI benchmark and comparison engine for every room.
++# Network (sign-in, JWKS, account events) should be up first, but Bench degrades honestly without it: the public
++# pages and API serve, and sign-in and the guarded routes wait for the signing key (see /api/ready).
++After=network.target postgresql.service pgbouncer.service valkey-server.service
++Wants=openvibe-network.service postgresql.service pgbouncer.service valkey-server.service
  
  [Service]
  Type=simple
--User=openvibe
++User=ubuntu
++Group=ubuntu
++WorkingDirectory=/opt/openvibe.bench
  EnvironmentFile=/etc/openvibe/bench.env
--ExecStart=/usr/bin/node /opt/openvibe/bench/server/index.js
--Restart=on-failure
++Environment=NODE_ENV=production
++Environment=PORT=5230
++Environment=HOST=127.0.0.1
++Environment=PATH=/usr/local/bin:/usr/bin:/bin
++ExecStart=/usr/bin/env node /opt/openvibe.bench/server/index.js
++Restart=always
  RestartSec=5
++KillSignal=SIGTERM
++# In-flight requests get the 10 s drain.
  TimeoutStopSec=15
++NoNewPrivileges=true
++PrivateTmp=true
++ProtectSystem=strict
++ProtectHome=true
++# OpenVibe.Bench's own database is PostgreSQL on the host's data role; the code tree stays read-only.
  
  [Install]
  WantedBy=multi-user.target