tor and capabilities

We should figure out what it takes to keep the CAP_NET_BIND_SERVICE capability when changing the user away from root, so that we can re-open low listening ports later again.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information