Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/home_assistant/templates/docker-compose.yml.j2

@@ -12,7 +12,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.ha.rule: "Host(`{{ ha_host }}`)"
       traefik.http.routers.ha.entrypoints: websecure
-      traefik.http.routers.ha.tls.certresolver: cloudflare
+      traefik.http.routers.ha.tls.certresolver: letsencrypt
       traefik.http.services.ha.loadbalancer.server.port: "8123"
     networks:
       - {{ docker_network_name }}
@@ -21,6 +21,7 @@ services:
     image: {{ esphome_image }}
     container_name: esphome
     restart: unless-stopped
+    privileged: true
     environment:
       TZ: {{ timezone }}
     volumes:
@@ -29,7 +30,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.esphome.rule: "Host(`{{ esphome_host }}`)"
       traefik.http.routers.esphome.entrypoints: websecure
-      traefik.http.routers.esphome.tls.certresolver: cloudflare
+      traefik.http.routers.esphome.tls.certresolver: letsencrypt
       traefik.http.services.esphome.loadbalancer.server.port: "6052"
     networks:
       - {{ docker_network_name }}