Relabel data bind mounts for SELinux (:Z)

App crashed on startup on brick (Permission denied @ dir_s_mkdir -
/app/data/gpx) — brick has SELinux enforcing, unlike cube, and Podman
denies a container write access to a bind-mounted host directory
without a relabel regardless of Unix permissions. Applied to both
maptool's ./data mount and kiwix's ZIM mount (same underlying cause,
would have hit this too once a real ZIM is placed there).

docker-compose.yaml

@@ -65,7 +65,12 @@ services:
       # happens outside this mount, in the container's own filesystem — a
       # large country's .osm.pbf plus Planetiler's working set can be
       # several GB, worth knowing if the host is ever short on space there.
-      - ./data:/app/data
+      # :Z (not :z — this path is only ever mounted into this one
+      # container) relabels the host directory for SELinux, since Podman
+      # on an SELinux-enforcing host otherwise denies the container write
+      # access to a bind-mounted directory regardless of Unix permissions
+      # — harmless/ignored on a host without SELinux.
+      - ./data:/app/data:Z
 
   # Fakes a GNSS fix (a loop around Bratislava, see
   # bin/gnss_simulator.rb/docs/development.adoc) since there's no real
@@ -118,4 +123,5 @@ services:
     # ever talks to this container directly.
     command: ["--urlRootLocation=/kiwix", "/data/wikipedia.zim"]
     volumes:
-      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim
+      # :Z, same SELinux reasoning as maptool's own ./data mount above.
+      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim:Z