Relabel data bind mounts for SELinux (:Z)

App crashed on startup on brick (Permission denied @ dir_s_mkdir -
/app/data/gpx) — brick has SELinux enforcing, unlike cube, and Podman
denies a container write access to a bind-mounted host directory
without a relabel regardless of Unix permissions. Applied to both
maptool's ./data mount and kiwix's ZIM mount (same underlying cause,
would have hit this too once a real ZIM is placed there).

docs/deployment.adoc

@@ -55,6 +55,13 @@ expect this to flip the other way, `/srv/docker` symlinked to
   only holds what's checked into this public repo, and gets wiped and
   replaced by the checkout sync on every deploy same as the rest of
   `build/`.
+  `data/` (and the kiwix ZIM path) carries a `:Z` SELinux relabel in
+  `docker-compose.yaml`'s bind mounts — without it, Podman on an
+  SELinux-enforcing host denies the container write access to the
+  bind-mounted directory regardless of its Unix permissions (surfaces
+  as a plain `Permission denied` in the app's own logs, nothing
+  SELinux-labeled unless you go looking in `audit.log`); harmless/
+  ignored on a host where SELinux isn't enforcing.
 * `.env` — regenerated every deploy (see below), lives here rather
   than in `build/` for the same reason as the symlink: `docker
   compose`/`podman compose` auto-load `.env` from the compose file's