Create and Harden a Custom systemd Service

A supplied application needs to run as a service under its own account, with a controlled environment, an automatic restart, and a filesystem sandbox that lets it write to one place and nothing else.