A rootless Docker service survives restart and published ports vanish

The daemon runs, yet inbound reachability is gone because its user-scoped networking helpers were not reestablished after boot in the same order.