Pasture: PrivaPub's uploads live in a volume

They lived in the container, so a container made again (a run with other settings)
lost every picture the town had posted from PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/lib/pasture.sh

@@ -19,12 +19,15 @@ pasture_base_up() {
 	cp "$here/appsettings.Pasture.json" "$publish/"
 	podman network exists $net || podman network create --subnet "$subnet" $net >/dev/null
 	podman volume exists pasture-caddy-data || podman volume create pasture-caddy-data >/dev/null
+	# (PrivaPub's uploads live in a volume: a container made again must not lose them)
+	podman volume exists pasture-privapub-media || podman volume create --label pasture=1 pasture-privapub-media >/dev/null
 	podman run -d --replace --name pasture-mongo --network $net --network-alias mongo docker.io/library/mongo:8 --quiet >/dev/null
 	caddy_up
 	local extra=()
 	for setting in ${PRIVAPUB_ENV:-}; do extra+=(-e "$setting"); done
 	podman run -d --replace --name pasture-privapub --network $net -p "127.0.0.1:$port:80" \
 		--sysctl net.ipv4.ip_unprivileged_port_start=0 -e ASPNETCORE_ENVIRONMENT=Pasture "${extra[@]}" -w /app -v "$publish:/app:Z,ro" \
+		-v pasture-privapub-media:/tmp/privapub-media \
 		mcr.microsoft.com/dotnet/runtime-deps:10.0 /app/PrivaPub >/dev/null
 	wait_http "http://127.0.0.1:$port/build.json"
 	rm -rf "$ca"; mkdir -p "$ca"