fix: final polish — teardown, image pin, license

README.md

@@ -37,7 +37,11 @@ Connections are merged from three layers. Higher layers win on name collisions.
 
 Rules:
 
-- When the same name appears in more than one layer, the higher layer wins.
+- Reads resolve name collisions by layer priority: env > config > store, so a
+  higher layer shadows a lower one with the same name. `list_connections`
+  reports the source layer that won.
+- Writes never create a new shadow: `add_connection` refuses a name that already
+  exists in any layer (env, config, or store), even one it cannot edit.
 - `add_connection`, `update_connection`, and `remove_connection` only touch the
   store layer. Editing a connection that came from the env or a config file
   returns an error naming its source.
@@ -51,7 +55,7 @@ rejected (the schemas are strict).
 
 | Field | Type | Notes |
 | --- | --- | --- |
-| `name` | string | matches `[a-zA-Z0-9_-]+`; unique across all layers |
+| `name` | string | matches `[a-zA-Z0-9_-]+`; `add_connection` refuses a name already present in any layer |
 | `type` | `postgres` \| `mysql` | the database engine |
 | `host` | string | database host |
 | `port` | number | defaults to `5432` (postgres) or `3306` (mysql) |
@@ -158,15 +162,27 @@ Run it from your client, persisting the store in a named volume:
     "mcpServers": {
         "dbmole": {
             "command": "docker",
-            "args": ["run", "-i", "--rm", "-v", "dbmole-store:/root/.config/dbmole", "dbmole-mcp"]
+            "args": [
+                "run",
+                "-i",
+                "--rm",
+                "-v",
+                "dbmole-store:/home/node/.config/dbmole",
+                "dbmole-mcp"
+            ]
         }
     }
 }
 ```
 
+The image runs as the non-root `node` user, so the store lives at
+`/home/node/.config/dbmole` — mount the volume there (as above).
+
 Note: when an SSH tunnel targets a bastion that is only reachable from the host,
 the usual Docker networking caveats apply. Use `host.docker.internal` (or host
-networking) so the container can reach it.
+networking) so the container can reach it. On Docker Desktop that name resolves
+automatically; on plain Linux Docker Engine you must add
+`--add-host=host.docker.internal:host-gateway` to the `docker run` args.
 
 ## Development