Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/authentik/docker-compose.yml

@@ -51,6 +51,8 @@ services:
     container_name: postgres_authentik
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [authentik]
     env_file:
       - stack.env
@@ -66,6 +68,8 @@ services:
     container_name: redis_authentik
     image: redis:7-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [authentik]
     command: --save 60 1 --loglevel warning
     volumes: