Fix: Start vpn-notify straight away in bootstrap.sh

`enable` alone only hooks it into graphical-session.target, which is
already active by the time bootstrap runs, so it didn't start until the
next login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bootstrap.sh

@@ -182,7 +182,7 @@ fi
 
 step "Enabling user services"
 systemctl --user daemon-reload
-systemctl --user enable vpn-notify.service
+systemctl --user enable --now vpn-notify.service
 
 if [[ "$(getent passwd "$USER" | cut -d: -f7)" != */zsh ]]; then
     step "Setting zsh as login shell"