Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/main.yml

@@ -36,10 +36,25 @@
     src: ufw-docker.sh
     dest: /usr/local/bin/ufw-docker.sh
     owner: root
-    mode: 755
+    mode: '0755'
 
-- name: execute ufw-docker.sh
-  ansible.builtin.shell: /usr/local/bin/ufw-docker.sh install
+- name: check ufw-docker rules
+  ansible.builtin.command: /usr/local/bin/ufw-docker.sh check
+  register: ufw_docker_check
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: install ufw-docker rules
+  ansible.builtin.command: /usr/local/bin/ufw-docker.sh install
+  when: ufw_docker_check.rc != 0
+
+# ufw-docker install asks for a ufw restart to load the new rules
+- name: restart ufw after ufw-docker install
+  ansible.builtin.systemd:
+    name: ufw
+    state: restarted
+  when: ufw_docker_check.rc != 0
 
 - name: make directories
   ansible.builtin.file:
@@ -54,7 +69,7 @@
     src: dockge-compose.yml.j2
     dest: /opt/dockge/dockge.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 # Deploy services by category for better organization and dependency management
 - name: Deploy infrastructure services