nym: polish Containerfile, compose, entrypoint, and README.

Host-side binary download notes and compose port mapping clarifications.

configs/nym/Containerfile

@@ -1,26 +1,34 @@
 # koopa-nym — nym-node (nym.com mixnet / NymVPN network)
 # Fetch binary on host first (see scripts/nym/build.sh), then:
 #   podman build -t localhost/koopa-nym:latest -f Containerfile .
+#
+# Process runs as uid/gid 1000 (not root). With rootless podman use
+# userns=keep-id so host ./data owned by hernani stays writable (see compose.yml).
 FROM docker.io/library/debian:bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive \
     NYM_HOME=/var/lib/nym \
-    PATH=/usr/local/bin:$PATH
+    PATH=/usr/local/bin:$PATH \
+    HOME=/var/lib/nym
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       ca-certificates libssl3 \
  && rm -rf /var/lib/apt/lists/* \
- && mkdir -p /var/lib/nym /usr/local/bin
+ && groupadd --gid 1000 nym \
+ && useradd --uid 1000 --gid 1000 --home-dir /var/lib/nym --shell /usr/sbin/nologin nym \
+ && mkdir -p /var/lib/nym /usr/local/bin \
+ && chown -R nym:nym /var/lib/nym
 
 # Pre-downloaded on host into build context as ./nym-node
 COPY nym-node /usr/local/bin/nym-node
-RUN chmod +x /usr/local/bin/nym-node \
+RUN chmod 755 /usr/local/bin/nym-node \
  && /usr/local/bin/nym-node --version || true
 
 COPY entrypoint.sh /usr/local/bin/nym-entrypoint
-RUN chmod +x /usr/local/bin/nym-entrypoint
+RUN chmod 755 /usr/local/bin/nym-entrypoint
 
 EXPOSE 1789/udp 1789/tcp 1790 8080 9000 51822/udp
 WORKDIR /var/lib/nym
+USER nym:nym
 ENTRYPOINT ["/usr/local/bin/nym-entrypoint"]