Harden permissions, close exposed ports, and clean up tasks

- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/syncthing-compose.yml.j2

@@ -6,7 +6,7 @@ services:
     labels:
       glance.name: Syncthing
       glance.icon: si:syncthing
-      glance.url: https://netcup.porgy-porgy.ts.net:8384
+      glance.url: https://{{ network.tailscale_hostname }}:8384
       glance.description: Syncthing core
       glance.id: Syncthing
       mag37.dockcheck.update: true
@@ -16,10 +16,10 @@ services:
     volumes:
       - home:/var/syncthing
     ports:
-      - 100.70.169.99:8384:8384 # Web UI
-      - 100.70.169.99:22000:22000/tcp # TCP file transfers
-      - 100.70.169.99:22000:22000/udp # QUIC file transfers
-      - 100.70.169.99:21027:21027/udp # Receive local discovery broadcasts
+      - {{ network.docker_host_ip }}:8384:8384 # Web UI
+      - {{ network.docker_host_ip }}:22000:22000/tcp # TCP file transfers
+      - {{ network.docker_host_ip }}:22000:22000/udp # QUIC file transfers
+      - {{ network.docker_host_ip }}:21027:21027/udp # Receive local discovery broadcasts
     restart: unless-stopped
     healthcheck:
       test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1