fix(sidecar): podman keep-id mapping so mutations land as the host user

Without keep-id the container's UID:GID maps into the rootless podman
subuid range (524288+), so the sidecar couldn't create
`/photoprism/originals/.duplicates/` — the archive endpoint failed
with "mkdir: permission denied", and rename / folder ops would have
hit the same wall.

The PhotoPrism container already has this override for the same
reason; mirror it for the sidecar.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.photoprism.podman.yml

@@ -26,3 +26,9 @@ services:
   # host UID that owns the bind-mounted originals/.
   photoprism:
     userns_mode: keep-id
+
+  # Sidecar mutates the originals tree (rename / folder ops / heap
+  # convert / .duplicates archive) — same keep-id mapping so its writes
+  # land as the host user, not as a podman-subuid the host doesn't own.
+  sidecar:
+    userns_mode: keep-id