Make sure user services are only run as ceres. Since openssh uses pam login, ssh root@watchIp would open a new systemd user session and start asteroid-launcher or other services as root

systemd: gives right to /dev/mm_interlock and /dev/mm_v3d to the video group to allow to run asteroid-launcher as ceres on tetra

This reverts commit 04acc8b6.