Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/dev/docker-compose.yml

@@ -55,6 +55,8 @@ services:
     container_name: postgres_gitea
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -162,8 +164,10 @@ services:
 
   mariadb_bookstack:
     container_name: mariadb_bookstack
-    image: lscr.io/linuxserver/mariadb:latest
+    image: lscr.io/linuxserver/mariadb:11.4.7
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -336,6 +340,8 @@ services:
     container_name: postgres_plane
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -355,6 +361,8 @@ services:
     container_name: redis_plane
     image: redis:7-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     command: --save 60 1 --loglevel warning
     volumes:
@@ -367,8 +375,10 @@ services:
 
   plane-minio:
     container_name: plane_minio
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     command: server /data --console-address ":9001"
     env_file: