Install the Windows service as the NT SERVICE virtual account only

--install-service now registers the service under
NT SERVICE\gpu-turnstile (low-privilege, per-service, no password) and
grants it modify access to the install dir (for self-updates) and the
LOG_FILE dir, plus read access to an external config file. Grants run
after CreateService because the virtual account's SID does not exist
before registration; a failed grant rolls back the registration.

README.md

@@ -110,10 +110,10 @@ environment); set `LOG_FILE` in it since there is no console.
 
 Suggested layout: `C:\Program Files\gpu-turnstile\` for the exe and
 `gpu-turnstile.env`, logs under `C:\ProgramData\gpu-turnstile\` via
-`LOG_FILE`. The service runs as `LocalSystem` by default, which can write
-the install directory for self-updates. For least privilege, run it as the
-virtual account `NT SERVICE\gpu-turnstile` and grant write access to just
-those two directories.
+`LOG_FILE`. The service always runs as the virtual account
+`NT SERVICE\gpu-turnstile` (low-privilege, per-service, no password); the
+installer automatically grants it write access to the install and log
+directories — nothing else to do.
 
 ### Run natively on Linux (systemd)