tor: container create helper and relay docs.

Document ORPort layout and host vs container tor coexistence.

configs/tor/create-container.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Recreate koopa-tor-relay as non-root (uid 1000) under rootless podman keep-id.
+# Run as hernani on koopa (not root). Stops/removes existing container first.
+set -euo pipefail
+
+NAME=koopa-tor-relay
+IMAGE="${TOR_IMAGE:-localhost/koopa-tor-relay:latest}"
+BASE="${KOOPA_TOR_BASE:-$HOME/koopa-tor-relay}"
+
+if [[ ! -f "$BASE/torrc" ]]; then
+  echo "ERROR: missing $BASE/torrc" >&2
+  exit 1
+fi
+mkdir -p "$BASE/data" "$BASE/log"
+# Host ownership: hernani (uid 1000) ↔ container debian-tor (uid 1000) via keep-id
+chmod 700 "$BASE/data" 2>/dev/null || true
+
+if podman ps -a --format '{{.Names}}' | grep -qx "$NAME"; then
+  podman stop "$NAME" 2>/dev/null || true
+  podman rm "$NAME"
+fi
+
+podman create \
+  --name "$NAME" \
+  --replace \
+  --network host \
+  --user 1000:1000 \
+  --userns keep-id \
+  --restart unless-stopped \
+  -v "$BASE/torrc:/etc/tor/torrc:ro" \
+  -v "$BASE/data:/var/lib/tor:Z" \
+  -v "$BASE/log:/var/log/tor:Z" \
+  --label org.hacktivism.service=tor \
+  --label org.hacktivism.container=koopa-tor-relay \
+  --label org.hacktivism.managed_by=koopa-admin \
+  "$IMAGE"
+
+echo "created $NAME (user 1000:1000, userns=keep-id, host net)"
+echo "start: podman start $NAME   # or systemctl --user start container-koopa-tor-relay"