OK. This is now all working. For anyone else who wants to use TFTP+NFS:
in /nfs/exports we need to use the no_xxx_squash options else both root+normal users get mapped to nobody
without both options set neither root nor normal users can log in
BTW the NFS host here is Debian which appears to default to all_squash.
~$ uname -a
Linux debi7 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1 (2015-05-24) x86_64 GNU/Linux