paivana: refresh compose, Containerfile, and conf template.

Keep GOA paywall container layout aligned with live deploy.

configs/paivana/compose.yml

@@ -8,6 +8,9 @@ services:
     image: localhost/koopa-paivana:latest
     container_name: koopa-paivana
     restart: unless-stopped
+    # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
+    user: "1000:1000"
+    userns_mode: keep-id
     ports:
       - "9025:9967"
     extra_hosts:
@@ -29,13 +32,14 @@ services:
       org.hacktivism.currency: GOA
 
   upstream:
-    image: docker.io/library/nginx:1.27-alpine
+    # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
+    image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
     container_name: koopa-paivana-upstream
     restart: unless-stopped
     volumes:
       - ./upstream:/usr/share/nginx/html:ro
     expose:
-      - "80"
+      - "8080"
     command: ["nginx", "-g", "daemon off;"]
     labels:
       org.hacktivism.service: paivana-upstream