Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/media/templates/docker-compose.yml.j2

@@ -13,7 +13,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.jellyfin.rule: "Host(`{{ jellyfin_host }}`)"
       traefik.http.routers.jellyfin.entrypoints: websecure
-      traefik.http.routers.jellyfin.tls.certresolver: cloudflare
+      traefik.http.routers.jellyfin.tls.certresolver: letsencrypt
       traefik.http.services.jellyfin.loadbalancer.server.port: "8096"
     networks:
       - {{ docker_network_name }}
@@ -27,14 +27,15 @@ services:
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
     volumes:
-      - {{ sonarr_data_dir }}:/config
+      - /data/sonarr/config:/config
       - {{ media_path }}/tv:/tv
       - {{ downloads_path }}:/downloads
+      - /data/media/ssd/tv_down:/tv_down
     labels:
       traefik.enable: "true"
       traefik.http.routers.sonarr.rule: "Host(`{{ sonarr_host }}`)"
       traefik.http.routers.sonarr.entrypoints: websecure
-      traefik.http.routers.sonarr.tls.certresolver: cloudflare
+      traefik.http.routers.sonarr.tls.certresolver: letsencrypt
       traefik.http.services.sonarr.loadbalancer.server.port: "8989"
     networks:
       - {{ docker_network_name }}
@@ -48,14 +49,16 @@ services:
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
     volumes:
-      - {{ radarr_data_dir }}:/config
+      - /data/radarr/config:/config
       - {{ media_path }}/movies:/movies
-      - {{ downloads_path }}:/downloads
+      - /data/media:/media
+      - /data/media/ssd/movies_down:/movies_down
+      - /data:/data
     labels:
       traefik.enable: "true"
       traefik.http.routers.radarr.rule: "Host(`{{ radarr_host }}`)"
       traefik.http.routers.radarr.entrypoints: websecure
-      traefik.http.routers.radarr.tls.certresolver: cloudflare
+      traefik.http.routers.radarr.tls.certresolver: letsencrypt
       traefik.http.services.radarr.loadbalancer.server.port: "7878"
     networks:
       - {{ docker_network_name }}
@@ -68,14 +71,19 @@ services:
       PUID: "{{ puid }}"
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
+    ports:
+      - "8082:8080"
+      - "9092:9090"
     volumes:
       - {{ sabnzbd_data_dir }}:/config
       - {{ downloads_path }}:/downloads
+      - /data/media/ssd/movies_down:/movies_down
+      - /data/media/ssd/tv_down:/tv_down
     labels:
       traefik.enable: "true"
       traefik.http.routers.sabnzbd.rule: "Host(`{{ sabnzbd_host }}`)"
       traefik.http.routers.sabnzbd.entrypoints: websecure
-      traefik.http.routers.sabnzbd.tls.certresolver: cloudflare
+      traefik.http.routers.sabnzbd.tls.certresolver: letsencrypt
       traefik.http.services.sabnzbd.loadbalancer.server.port: "8080"
     networks:
       - {{ docker_network_name }}
@@ -106,7 +114,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.jellyseerr.rule: "Host(`{{ jellyseerr_host }}`)"
       traefik.http.routers.jellyseerr.entrypoints: websecure
-      traefik.http.routers.jellyseerr.tls.certresolver: cloudflare
+      traefik.http.routers.jellyseerr.tls.certresolver: letsencrypt
       traefik.http.services.jellyseerr.loadbalancer.server.port: "5055"
     networks:
       - {{ docker_network_name }}