Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/resume/docker-compose.yml

@@ -11,6 +11,8 @@ services:
     container_name: postgres_resume
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume]
     volumes:
       - /config/resume/postgres:/var/lib/postgresql/data
@@ -27,8 +29,10 @@ services:
 
   resume-minio:
     container_name: minio_resume
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume, edge]
     command: server /data --console-address :9001
     ports:
@@ -93,6 +97,10 @@ services:
       - STORAGE_BUCKET=default
       - STORAGE_USE_SSL=false
       - STORAGE_SKIP_BUCKET_CHECK=false
+      - OAUTH_PROVIDER_NAME=Authentik
+      - OAUTH_DISCOVERY_URL=https://auth.ginnoir.com/application/o/resume/.well-known/openid-configuration
+      - FLAG_DISABLE_EMAIL_AUTH=true
+      - FLAG_DISABLE_SIGNUPS=true
 
 networks:
   resume: