Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/authentik/scripts/setup-batch1-oidc.py

@@ -17,6 +17,12 @@ OIDC_APPS = [
     ("gitea", "gitea", ["https://gitea.ginnoir.com/user/oauth2/Authentik/callback"]),
     ("portainer", "portainer", ["https://portainer.ginnoir.com/"]),
     ("minio", "minio-console", ["https://minio.ginnoir.com/oauth_callback"]),
+    ("owncloud", "owncloud-web", [
+        "https://files.ginnoir.com/index.php/apps/openidconnect/redirect",
+        "https://files.ginnoir.com/apps/openidconnect/redirect",
+    ]),
+    ("resume", "reactive-resume", ["https://resume.ginnoir.com/api/auth/oauth2/callback/custom"]),
+    ("freshrss", "freshrss", ["https://freshrss.ginnoir.com/i/oidc/"]),
 ]
 
 native_slugs = []
@@ -63,6 +69,9 @@ PROXY_NAMES = {
     "gitea": "homelab-gitea",
     "portainer": "homelab-portainer",
     "minio": "homelab-minio",
+    "owncloud": "homelab-files",
+    "resume": "homelab-resume",
+    "freshrss": "homelab-freshrss",
 }
 outpost = Outpost.objects.get(name="authentik Embedded Outpost")
 for slug in native_slugs: