Create the smallwebwaf user without useradd's uid warning (closes #58)

useradd --system warns when the uid it is given is above SYS_UID_MAX,
999 on Ubuntu; --key raises that limit for this one call, so the uid
stays 65532.

The issue's two other warnings stay, since each needs a change to an
outside tool: minsysusers, which runit's install runs to create its
_runit-log user, reads a shell field that runit's sysusers line leaves
out; runsvinit's reaper and its own wait on runsvdir race for the same
exited process.

Model: opus-5-5

Dockerfile

@@ -130,9 +130,12 @@ ENV PATH=${PATH}:/nix/var/nix/profiles/default/bin
 COPY --from=runsvinit /usr/local/bin/runsvinit /usr/local/bin/runsvinit
 COPY --from=builder /usr/local/bin/smallwebwaf /usr/local/bin/smallwebwaf
 
+# 65532 is above the uids Ubuntu keeps for system users, which end at
+# 999; useradd warns about it unless --key raises that end for this call.
 RUN groupadd --system --gid 65532 smallwebwaf \
-    && useradd --system --uid 65532 --gid smallwebwaf --no-create-home \
-        --shell /usr/sbin/nologin smallwebwaf
+    && useradd --system --key SYS_UID_MAX=65532 --uid 65532 \
+        --gid smallwebwaf --no-create-home --shell /usr/sbin/nologin \
+        smallwebwaf
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv
 # looks too.