fix: make docker entrypoint restart-safe

docker compose restart reuses the container, so the overlay fs keeps the
user created on first boot; a second useradd fails with exit code 9 and
set -e kills the container on every restart (crash loop, bot never comes
back). Create the user only if missing, align UID otherwise, and never
let chown failure on bind-mounted volumes kill the container.

Also comment out nginx-proxy's empty environment block in the compose
example: an empty mapping fails validation on newer compose versions
(must be a mapping).

docker-compose.yml.example

@@ -5,9 +5,9 @@ services:
     ports:
       - '80:80'
       - '443:443'
-    environment:
-      # Bare-IP access only.
-      # DEFAULT_HOST: 'bot.example.com'
+    # Bare-IP access only. Uncomment to enable.
+    # environment:
+    #   DEFAULT_HOST: 'bot.example.com'
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
       - ./nginx-certs:/etc/nginx/certs:ro