Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

Caddyfile

@@ -55,9 +55,13 @@ pf2e.ginnoir.com {
 }
 
 # =============================================================
-# FILE STORAGE — public
+# FILE STORAGE — public (Authentik on admin UI; shares + WebDAV bypass)
 # =============================================================
 files.ginnoir.com {
+	handle /.well-known/openid-configuration {
+		rewrite * /index.php/apps/openidconnect/config
+		reverse_proxy owncloud:8080
+	}
 	reverse_proxy owncloud:8080
 }
 
@@ -208,6 +212,11 @@ romhacks.ginnoir.com {
 	file_server
 }
 
+jd.ginnoir.com {
+	import internal_only
+	reverse_proxy jdownloader:5800
+}
+
 # Pokémon ROM-hack library files (box art, guides, spreadsheets) for the
 # Obsidian catalog notes. Internal-only — these downloads are private.
 # Root is the read-only /storage1/labdata/romhacks/library bind from the proxy
@@ -225,7 +234,7 @@ romhacks-files.ginnoir.com {
 }
 
 # =============================================================
-# NOTIFICATIONS & RSS — public
+# NOTIFICATIONS & RSS — public (ntfy native auth; FreshRSS HTTP auth via Authentik)
 # =============================================================
 ntfy.ginnoir.com, http://ntfy.ginnoir.com {
 	reverse_proxy ntfy:80
@@ -242,7 +251,7 @@ freshrss.ginnoir.com {
 }
 
 # =============================================================
-# RESUME / PORTFOLIO — public
+# RESUME / PORTFOLIO — public (native OIDC via Authentik; no forward_auth)
 # =============================================================
 resume.ginnoir.com {
 	reverse_proxy app:3000
@@ -270,6 +279,7 @@ storage.j-costa.com, https://storage.j-costa.com {
 # MINIO CONSOLE — internal only
 # =============================================================
 minio.ginnoir.com {
+	import internal_only
 	reverse_proxy resume-minio:9001
 }
 
@@ -315,6 +325,7 @@ uptime.ginnoir.com {
 }
 
 homarr.ginnoir.com {
+	import internal_only
 	reverse_proxy homarr:7575
 }
 
@@ -400,6 +411,7 @@ vault.ginnoir.com {
 }
 
 docs.ginnoir.com {
+	import internal_only
 	reverse_proxy bookstack:80
 }