Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

inventory/group_vars/all.yml

@@ -20,9 +20,9 @@ traefik_acme_email: "{{ vault_acme_email }}"
 cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
 
 # NAS mounts
-nas_media_path: /mnt/nas/media
-nas_backup_path: /mnt/nas/backups
-nas_docker_path: /mnt/nas/docker
+nas_media_path: /data/media
+nas_backup_path: /data/backups
+nas_docker_path: /data/docker
 
 # Common packages
 common_packages: