ghcr.io/9001/copyparty:latest does not exist — ghcr answers 403 on the token request for nonexistent repos, which is why the bring-up failed at pull. The upstream publishes ghcr.io/9001/copyparty-ac (ac = full edition) and serves whatever is mounted at /w, so the compose mounts the LUKS array there; config persists in /opt/copyparty/cfg per upstream layout.