Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

scripts/run-batch1-oidc.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+docker cp /tmp/setup-batch1-oidc.py authentik_server:/tmp/setup-batch1-oidc.py
+docker exec authentik_server ak shell -c "exec(open('/tmp/setup-batch1-oidc.py').read())"