Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/owncloud/docker-compose.yml

@@ -37,9 +37,11 @@ services:
       - /storage1/ROMs:/mnt/roms
 
   mariadb:
-    image: mariadb:latest
+    image: mariadb:12.3
     container_name: owncloud_mariadb
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [owncloud]
     env_file:
       - stack.env
@@ -56,9 +58,11 @@ services:
       - /config/mysql:/var/lib/mysql
 
   redis:
-    image: redis:latest
+    image: redis:7-alpine
     container_name: owncloud_redis
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [owncloud]
     command: ["--databases", "1"]
     healthcheck: