Relabel data bind mounts for SELinux (:Z)

App crashed on startup on brick (Permission denied @ dir_s_mkdir -
/app/data/gpx) — brick has SELinux enforcing, unlike cube, and Podman
denies a container write access to a bind-mounted host directory
without a relabel regardless of Unix permissions. Applied to both
maptool's ./data mount and kiwix's ZIM mount (same underlying cause,
would have hit this too once a real ZIM is placed there).

docker-compose.yaml

@@ -65,7 +65,12 @@ services:
       # happens outside this mount, in the container's own filesystem — a
       # large country's .osm.pbf plus Planetiler's working set can be
       # several GB, worth knowing if the host is ever short on space there.
-      - ./data:/app/data
+      # :Z (not :z — this path is only ever mounted into this one
+      # container) relabels the host directory for SELinux, since Podman
+      # on an SELinux-enforcing host otherwise denies the container write
+      # access to a bind-mounted directory regardless of Unix permissions
+      # — harmless/ignored on a host without SELinux.
+      - ./data:/app/data:Z
 
   # Fakes a GNSS fix (a loop around Bratislava, see
   # bin/gnss_simulator.rb/docs/development.adoc) since there's no real
@@ -118,4 +123,5 @@ services:
     # ever talks to this container directly.
     command: ["--urlRootLocation=/kiwix", "/data/wikipedia.zim"]
     volumes:
-      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim
+      # :Z, same SELinux reasoning as maptool's own ./data mount above.
+      - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim:Z

docs/deployment.adoc

@@ -55,6 +55,13 @@ expect this to flip the other way, `/srv/docker` symlinked to
   only holds what's checked into this public repo, and gets wiped and
   replaced by the checkout sync on every deploy same as the rest of
   `build/`.
+  `data/` (and the kiwix ZIM path) carries a `:Z` SELinux relabel in
+  `docker-compose.yaml`'s bind mounts — without it, Podman on an
+  SELinux-enforcing host denies the container write access to the
+  bind-mounted directory regardless of its Unix permissions (surfaces
+  as a plain `Permission denied` in the app's own logs, nothing
+  SELinux-labeled unless you go looking in `audit.log`); harmless/
+  ignored on a host where SELinux isn't enforcing.
 * `.env` — regenerated every deploy (see below), lives here rather
   than in `build/` for the same reason as the symlink: `docker
   compose`/`podman compose` auto-load `.env` from the compose file's