library: run bootstrap via runuser, keep mpm_itk, add SETUID/SETGID caps

- koha-shell -c wraps the command in single quotes, which broke the env
  assignments; use runuser + env instead and verify tables were created
- koha-create requires mpm_itk, so keep it and grant the caps it needs
- stop any Apache started by koha-create before running it in foreground

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/docker-compose.yml

@@ -37,6 +37,10 @@ services:
       KOHA_ADMIN_USER: ${ADMIN_USER:-admin}
       KOHA_ADMIN_PASS: ${ADMIN_PASSWORD}
       KOHA_LIBRARY_NAME: ${LIBRARY_NAME:-My Library}
+    # Koha's Apache uses mpm_itk, which switches users per request.
+    cap_add:
+      - SETUID
+      - SETGID
     ports:
       - "${OPAC_PORT:-8080}:80"
       - "${STAFF_PORT:-8081}:8081"