docs(docker): run as root under host networking to bind port 79

Host networking shares the host net namespace, so the host's
privileged-port rule applies and the image's non-root user cannot bind 79
-- the daemon fails to listen silently. Add user: "0:0" to the compose and
correct the earlier (wrong) claim that non-root bind still works. Note
setcap as the non-root alternative.

docker-compose.yml

@@ -9,9 +9,14 @@ services:
     # single source IP for everyone -- the per-IP ban logic can't tell clients
     # apart and (by design) treats that private address as untrackable, leaving
     # banning inert. Host networking exposes the real client IP, so repeat
-    # offenders actually get blocked. (Non-root bind of port 79 still works:
-    # Docker grants CAP_NET_BIND_SERVICE by default.)
+    # offenders actually get blocked.
     network_mode: host
+    # Under host networking the container shares the host net namespace, which
+    # uses the host's privileged-port rule -- so the image's non-root user
+    # (UID 1000) cannot bind port 79 and the daemon fails to listen silently.
+    # Run as root to bind it. (Alternative: setcap cap_net_bind_service on the
+    # binary in the image to keep it non-root.)
+    user: "0:0"
     volumes:
       - ./users:/var/finger/users
     restart: unless-stopped