Adds a system user 'podman' (uid 900) with subuid/subgid ranges
and linger for running OCI containers. Removes podman-specific
settings from lew user. DokuWiki switches to sdnotify=healthy
since the image has a built-in healthcheck.
The oci-containers module has native rootless support via podman.user
which handles cgroup delegation, runtime dirs, and cidfile paths.
Delegate=true workaround for NixOS/nixpkgs#410857.
