docs: all production containers autostart on koopa reboot

Record podman-restart.service, unless-stopped policies, and per-container user units.

2026/2026-07-16--container-autostart.md

@@ -0,0 +1,37 @@
+# Container autostart on reboot — 2026-07-16
+
+## How it is set (hernani@koopa, rootless podman)
+
+1. **`loginctl` Linger=yes** for `hernani` — user systemd runs without login.
+2. **`podman-restart.service` (user)** enabled — on boot starts all containers with
+   restart policy that should come up (`unless-stopped` / `always`, not manually stopped).
+3. **Per-container (or stack) user units** under `~/.config/systemd/user/container-*.service`
+   also enabled (belt-and-suspenders + DB ordering drop-ins).
+4. **Restart policy** on every production container: **`unless-stopped`**.
+
+## Production set (should-start-on-boot)
+
+| Container |
+|-----------|
+| `taler-hacktivism`, `taler-hacktivism-bank`, `taler-hacktivism-exchange-ansible` |
+| `koopa-forgejo`, `koopa-forgejo-db` |
+| `koopa-prime-jellyfin`, `koopa-prime-qbittorrent` |
+| `koopa-tor-relay`, `koopa-nym` |
+| `koopa-bonfire`, `koopa-bonfire-db` |
+| `koopa-castopod`, `koopa-castopod-mariadb`, `koopa-castopod-redis` |
+| `koopa-paivana`, `koopa-paivana-upstream` |
+| `koopa-tops-ng1` … `ng3` (+ `container-koopa-tops.service` ensure) |
+
+## Changed this day
+
+- Taler stack: `restart=no` → **`unless-stopped`**
+- New units: forgejo(+db), prime jellyfin/qbittorrent, paivana-upstream, three taler containers
+- Enabled **`podman-restart.service`**
+
+## Checks after reboot
+
+```bash
+systemctl --user is-enabled podman-restart.service
+podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}'
+systemctl --user --failed
+```

2026/2026-07-16.md

@@ -1,3 +1,4 @@
 # 2026-07-16
 
 - **koopa-nym** (nym.com) mirror → `2026-07-16--koopa-nym.md`
+- **container autostart** (podman-restart + units) → `2026-07-16--container-autostart.md`