chore: consistency pass — restart policies, backdoor ports, remove dead services

docker-compose.yml:
- Remove jackett and nzbhydra2 services
- Fix restart: "no" → unless-stopped on deluge, nzbget, sonarr, radarr, bazarr, tautulli
- Fix restart: always → unless-stopped on owncloud, mariadb (owncloud), redis (owncloud)
- Add backdoor host ports: portainer 9100:9000, uptime-kuma 3001:3001, homarr 7575:7575

Caddyfile:
- Remove jackett.ginnoir.com and hydra.ginnoir.com blocks
- Drop stray @httpget redirect blocks from freshrss, resume, storage.j-costa.com
- Simplify resume.ginnoir.com (drop redundant https:// host alias)
- Fix tab indentation in j-costa.com and storage.j-costa.com tls blocks
- Fix space indent in dev.ginnoir.com

.env:
- Remove unused famapp_MINIO_ENDPOINT (hardcoded in compose)
- Remove unused NEXT_PUBLIC_APP_URL

Caddyfile

@@ -78,11 +78,6 @@ bazarr.ginnoir.com {
 	reverse_proxy bazarr:6767
 }
 
-jackett.ginnoir.com {
-	import internal_only
-	reverse_proxy jackett:9117
-}
-
 prowlarr.ginnoir.com {
 	import internal_only
 	reverse_proxy prowlarr:9696
@@ -93,11 +88,6 @@ tautulli.ginnoir.com {
 	reverse_proxy tautulli:8181
 }
 
-hydra.ginnoir.com {
-	import internal_only
-	reverse_proxy nzbhydra2:5076
-}
-
 # =============================================================
 # DOWNLOAD CLIENTS — internal only
 # =============================================================
@@ -141,49 +131,31 @@ ntfy.ginnoir.com, http://ntfy.ginnoir.com {
 
 freshrss.ginnoir.com {
 	reverse_proxy freshrss:80
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 # =============================================================
 # RESUME / PORTFOLIO — public
 # =============================================================
-resume.ginnoir.com, https://resume.ginnoir.com {
+resume.ginnoir.com {
 	reverse_proxy app:3000
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 j-costa.com, https://j-costa.com {
 	tls {
-            issuer acme {
-                disable_tlsalpn_challenge
-            }
+		issuer acme {
+			disable_tlsalpn_challenge
+		}
 	}
 	redir * https://resume.ginnoir.com/ginnoir/resume permanent
 }
 
 storage.j-costa.com, https://storage.j-costa.com {
 	tls {
-            issuer acme {
-                disable_tlsalpn_challenge
-            }
+		issuer acme {
+			disable_tlsalpn_challenge
+		}
 	}
 	reverse_proxy resume-minio:9000
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 # =============================================================
@@ -206,7 +178,7 @@ auth.ginnoir.com {
 }
 
 dev.ginnoir.com {
-       reverse_proxy 192.168.1.74:3000
+	reverse_proxy 192.168.1.74:3000
 }
 
 # =============================================================