Drop the PORT=3000 override from the quadlet so the container listens
on PORT from config.env like the native service, and publish
127.0.0.1:3128:3128. Move PublishPort into a %config(noreplace) quadlet
drop-in, /etc/containers/systemd/turborepo-remote-cache.container.d/
publish-port.conf, so hosts can change the host binding without an
untracked override. Document in config.env that the container
overrides HOST and that the listen address belongs in PublishPort.
