Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/media/docker-compose.yml

@@ -158,6 +158,17 @@ services:
     ports:
       - "6969:6969"
 
+  recyclarr:
+    image: ghcr.io/recyclarr/recyclarr:8
+    container_name: recyclarr
+    restart: unless-stopped
+    networks: [media]
+    user: 1000:1000
+    env_file:
+      - stack.env
+    volumes:
+      - ./recyclarr:/config
+
   stash:
     image: stashapp/stash:latest
     container_name: stash

stacks/media/recyclarr/recyclarr.yml

@@ -0,0 +1,25 @@
+# TRaSH Guides sync — WEB-1080p (Sonarr) + HD Bluray + WEB (Radarr).
+# Run manually: docker exec recyclarr recyclarr sync
+sonarr:
+  main:
+    base_url: http://sonarr:8989
+    api_key: !secret sonarr_api_key
+    delete_old_custom_formats: true
+    quality_definition:
+      type: series
+    quality_profiles:
+      - trash_id: 72dae194fc92bf828f32cde74482a9dde
+        reset_unmatched_scores:
+          enabled: true
+
+radarr:
+  main:
+    base_url: http://radarr:7878
+    api_key: !secret radarr_api_key
+    delete_old_custom_formats: true
+    quality_definition:
+      type: movie
+    quality_profiles:
+      - trash_id: d1d67249d3890e49bc12e275d989a7e9
+        reset_unmatched_scores:
+          enabled: true

stacks/media/recyclarr/secrets.yml

@@ -0,0 +1,2 @@
+sonarr_api_key: "383c9489253e445baf8514013a4e37a4"
+radarr_api_key: "94159a19beef48f185bd3e330f8dde3a"