chore: consistency pass — restart policies, backdoor ports, remove dead services

docker-compose.yml:
- Remove jackett and nzbhydra2 services
- Fix restart: "no" → unless-stopped on deluge, nzbget, sonarr, radarr, bazarr, tautulli
- Fix restart: always → unless-stopped on owncloud, mariadb (owncloud), redis (owncloud)
- Add backdoor host ports: portainer 9100:9000, uptime-kuma 3001:3001, homarr 7575:7575

Caddyfile:
- Remove jackett.ginnoir.com and hydra.ginnoir.com blocks
- Drop stray @httpget redirect blocks from freshrss, resume, storage.j-costa.com
- Simplify resume.ginnoir.com (drop redundant https:// host alias)
- Fix tab indentation in j-costa.com and storage.j-costa.com tls blocks
- Fix space indent in dev.ginnoir.com

.env:
- Remove unused famapp_MINIO_ENDPOINT (hardcoded in compose)
- Remove unused NEXT_PUBLIC_APP_URL

.env

@@ -82,7 +82,6 @@ AUTHENTIK_DB_NAME=authentik
 AUTHENTIK_SECRET_KEY=C33S/oXOVOLrlLnWGMRYadgH9zfEC7Bm1vHtbczkFxHcTOj9j6io397c/OGb
 
 # MinIO object storage (used for plant/container image uploads)
-famapp_MINIO_ENDPOINT=http://minio:9000
 famapp_MINIO_ROOT_USER=famapp
 famapp_MINIO_ROOT_PASSWORD=d0fet0th3x
 famapp_MINIO_BUCKET=garden

Caddyfile

@@ -78,11 +78,6 @@ bazarr.ginnoir.com {
 	reverse_proxy bazarr:6767
 }
 
-jackett.ginnoir.com {
-	import internal_only
-	reverse_proxy jackett:9117
-}
-
 prowlarr.ginnoir.com {
 	import internal_only
 	reverse_proxy prowlarr:9696
@@ -93,11 +88,6 @@ tautulli.ginnoir.com {
 	reverse_proxy tautulli:8181
 }
 
-hydra.ginnoir.com {
-	import internal_only
-	reverse_proxy nzbhydra2:5076
-}
-
 # =============================================================
 # DOWNLOAD CLIENTS — internal only
 # =============================================================
@@ -141,49 +131,31 @@ ntfy.ginnoir.com, http://ntfy.ginnoir.com {
 
 freshrss.ginnoir.com {
 	reverse_proxy freshrss:80
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 # =============================================================
 # RESUME / PORTFOLIO — public
 # =============================================================
-resume.ginnoir.com, https://resume.ginnoir.com {
+resume.ginnoir.com {
 	reverse_proxy app:3000
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 j-costa.com, https://j-costa.com {
 	tls {
-            issuer acme {
+		issuer acme {
-                disable_tlsalpn_challenge
+			disable_tlsalpn_challenge
-            }
+		}
 	}
 	redir * https://resume.ginnoir.com/ginnoir/resume permanent
 }
 
 storage.j-costa.com, https://storage.j-costa.com {
 	tls {
-            issuer acme {
+		issuer acme {
-                disable_tlsalpn_challenge
+			disable_tlsalpn_challenge
-            }
+		}
 	}
 	reverse_proxy resume-minio:9000
-	@httpget {
-		protocol http
-		method GET
-		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-	}
-	redir @httpget https://{host}{uri}
 }
 
 # =============================================================
@@ -206,7 +178,7 @@ auth.ginnoir.com {
 }
 
 dev.ginnoir.com {
-       reverse_proxy 192.168.1.74:3000
+	reverse_proxy 192.168.1.74:3000
 }
 
 # =============================================================

docker-compose.yml

@@ -94,7 +94,7 @@ services:
   deluge:
     container_name: deluge
     image: lscr.io/linuxserver/deluge:latest
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -110,7 +110,7 @@ services:
   nzbget:
     container_name: nzbget
     image: lscr.io/linuxserver/nzbget:latest
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -126,7 +126,7 @@ services:
   sonarr:
     container_name: sonarr
     image: lscr.io/linuxserver/sonarr:latest
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -145,7 +145,7 @@ services:
   radarr:
     container_name: radarr
     image: lscr.io/linuxserver/radarr:latest
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -163,7 +163,7 @@ services:
   bazarr:
     container_name: bazarr
     image: lscr.io/linuxserver/bazarr:latest
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -179,22 +179,6 @@ services:
     ports:
       - "6767:6767"
 
-  jackett:
-    container_name: jackett
-    image: ghcr.io/hotio/jackett:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - UMASK=002
-      - TZ=${TZ}
-    volumes:
-      - /config/jackett:/config
-    ports:
-      - "9117:9117"
-
   prowlarr:
     container_name: prowlarr
     image: ghcr.io/hotio/prowlarr:latest
@@ -233,7 +217,7 @@ services:
   tautulli:
     image: ghcr.io/linuxserver/tautulli:latest
     container_name: tautulli
-    restart: "no"
+    restart: unless-stopped
     networks:
       - media
     environment:
@@ -246,22 +230,6 @@ services:
     ports:
       - "8181:8181"
 
-  nzbhydra2:
-    image: ghcr.io/linuxserver/nzbhydra2:latest
-    container_name: nzbhydra2
-    restart: "no"
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - ${ROOT}/config/nzbhydra:/config
-      - ${ROOT}/storage1/complete:/downloads
-    ports:
-      - "5076:5076"
-
   qbittorrent:
     image: lscr.io/linuxserver/qbittorrent:latest
     container_name: qbittorrent
@@ -336,7 +304,7 @@ services:
   owncloud:
     image: owncloud/server:latest
     container_name: owncloud_server
-    restart: always
+    restart: unless-stopped
     networks:
       - owncloud
     ports:
@@ -372,7 +340,7 @@ services:
   mariadb:
     image: mariadb:latest
     container_name: owncloud_mariadb
-    restart: always
+    restart: unless-stopped
     networks:
       - owncloud
     environment:
@@ -392,7 +360,7 @@ services:
   redis:
     image: redis:latest
     container_name: owncloud_redis
-    restart: always
+    restart: unless-stopped
     networks:
       - owncloud
     command: ["--databases", "1"]
@@ -604,6 +572,8 @@ services:
     restart: unless-stopped
     networks:
       - management
+    ports:
+      - "9100:9000"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /config/portainer:/data
@@ -614,6 +584,8 @@ services:
     restart: unless-stopped
     networks:
       - management
+    ports:
+      - "3001:3001"
     volumes:
       - /config/uptime-kuma:/app/data
       - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -626,6 +598,8 @@ services:
       - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY}
     networks:
       - management
+    ports:
+      - "7575:7575"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /config/homarr/configs:/app/data/configs