Add Podman Libpod pods, secrets, and operator hardening.

Expose pods and file-backed secrets via the Libpod API, pin the Engine
API for Podman, improve rootless/SELinux/port error guidance, and document
socket, linger, and auth.json setup for rootful and rootless hosts.

deploy/peardock.service

@@ -3,8 +3,10 @@ Description=peardock HyperDHT Docker control plane
 Documentation=https://git.ssh.surf/snxraven/peardock
 After=network-online.target
 Wants=network-online.target
-# Soft-depend on Docker (rootless / podman setups may not ship docker.service)
+# Soft-depend on Docker / Podman (either socket is enough)
 Wants=docker.service
+# Rootful Podman API (optional; ignore if unit missing)
+# Wants=podman.socket
 
 [Service]
 Type=simple
@@ -30,9 +32,12 @@ EnvironmentFile=-/opt/peardock/.env
 # Example production knobs (prefer .env):
 # Environment=PEARDOCK_DEFAULT_ROLE=operator
 # Environment=PEARDOCK_PEER_ALLOWLIST=1
-# Swarm + Holesail are on by default; opt out with ENABLE_*=0
+# Environment=PEARDOCK_ENGINE=podman
+# Environment=DOCKER_HOST=unix:///run/podman/podman.sock
+# Swarm + Holesail are on by default (Docker); Swarm is always off on Podman
 # Environment=ENABLE_SWARM=0
 # Environment=ENABLE_HOLESAIL=0
+# Environment=DOCKER_API_VERSION=v1.41
 
 ReadWritePaths=/opt/peardock