Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/tasks/monitoring/appriseapi.yml

@@ -10,7 +10,7 @@
     src: appriseapi-compose.yml.j2
     dest: /opt/stacks/appriseapi/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy appriseapi stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/changedetection.yml

@@ -10,7 +10,7 @@
     src: changedetection-compose.yml.j2
     dest: /opt/stacks/changedetection/compose.yml
     owner: root
-    mode: 644
+    mode: '0644'
 
 - name: deploy changedetection stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/cronmaster.yml

@@ -13,7 +13,8 @@
     src: cronmaster-compose.yml.j2
     dest: /opt/stacks/cronmaster/compose.yml
     owner: root
-    mode: '0644'
+    mode: '0640'
+    group: docker
 
 - name: deploy cronmaster stack
   community.docker.docker_compose_v2:

roles/docker/tasks/monitoring/glance.yml

@@ -18,7 +18,8 @@
     src: glance.yml.j2
     dest: /opt/stacks/glance/config/glance.yml
     owner: root
-    mode: '0644'
+    mode: '0640'
+    group: docker
   notify: restart glance
 
 - name: deploy glances stack

roles/docker/tasks/monitoring/gotify.yml

@@ -10,7 +10,8 @@
     src: gotify-compose.yml.j2
     dest: /opt/stacks/gotify/compose.yml
     owner: root
-    mode: 644
+    mode: '0640'
+    group: docker
 
 - name: Deploy gotify stack
   community.docker.docker_compose_v2: