Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -94,7 +94,7 @@ roles/docker/
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
-│   │   └── codeserver.yml         # VS Code server
+│   │   └── bytestash.yml          # Code snippets
 │   ├── media/                     # Media services (7 services)
 │   ├── productivity/              # Productivity services (7 services)
 │   ├── communication/             # Communication services (2 services)
@@ -137,8 +137,8 @@ ansible-playbook site.yml -i hosts.yml --tags infrastructure,monitoring
 ```bash
 # Deploy specific services
 ansible-playbook site.yml -i hosts.yml --tags authentik
-ansible-playbook site.yml -i hosts.yml --tags gitea,codeserver
-ansible-playbook site.yml -i hosts.yml --tags mmdl
+ansible-playbook site.yml -i hosts.yml --tags gitea,bytestash
+ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ```
 
 ## Service-Specific Notes