Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/communication/gotosocial.yml

@@ -11,7 +11,8 @@
     src: gotosocial-compose.yml.j2
     dest: /opt/stacks/gotosocial/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy gotosocial stack
   community.docker.docker_compose_v2:

roles/docker/tasks/communication/listmonk.yml

@@ -10,7 +10,8 @@
     src: listmonk-compose.yml.j2
     dest: /opt/stacks/listmonk/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: deploy listmonk stack
   community.docker.docker_compose_v2:

roles/docker/tasks/communication/main.yml

@@ -5,10 +5,7 @@
   import_tasks: gotosocial.yml
   tags: gotosocial
 
-- name: Install postiz
-  import_tasks: postiz.yml
-  tags: postiz
 
 - name: Install listmonk
   import_tasks: listmonk.yml
-  tags: listmonk
+  tags: listmonk

roles/docker/tasks/communication/postiz.yml

@@ -1,11 +0,0 @@
----
-- name: Stop and remove postiz stack
-  community.docker.docker_compose_v2:
-    project_src: /opt/stacks/postiz
-    state: absent
-  ignore_errors: true
-
-- name: Remove postiz directory
-  ansible.builtin.file:
-    path: /opt/stacks/postiz
-    state: absent