Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/monitoring/templates/docker-compose.yml.j2

@@ -3,6 +3,8 @@ services:
     image: {{ prometheus_image }}
     container_name: prometheus
     restart: unless-stopped
+    ports:
+      - "9095:9090"
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus
@@ -15,7 +17,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.prometheus.rule: "Host(`{{ prometheus_host }}`)"
       traefik.http.routers.prometheus.entrypoints: websecure
-      traefik.http.routers.prometheus.tls.certresolver: cloudflare
+      traefik.http.routers.prometheus.tls.certresolver: letsencrypt
       traefik.http.services.prometheus.loadbalancer.server.port: "9090"
     networks:
       - {{ docker_network_name }}
@@ -24,6 +26,8 @@ services:
     image: {{ grafana_image }}
     container_name: grafana
     restart: unless-stopped
+    ports:
+      - "3001:3000"
     environment:
       GF_SECURITY_ADMIN_PASSWORD: {{ grafana_admin_password }}
       GF_SERVER_ROOT_URL: "https://{{ grafana_host }}"
@@ -34,7 +38,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.grafana.rule: "Host(`{{ grafana_host }}`)"
       traefik.http.routers.grafana.entrypoints: websecure
-      traefik.http.routers.grafana.tls.certresolver: cloudflare
+      traefik.http.routers.grafana.tls.certresolver: letsencrypt
       traefik.http.services.grafana.loadbalancer.server.port: "3000"
     networks:
       - {{ docker_network_name }}
@@ -43,6 +47,8 @@ services:
     image: {{ alertmanager_image }}
     container_name: alertmanager
     restart: unless-stopped
+    ports:
+      - "9093:9093"
     command:
       - --config.file=/etc/alertmanager/alertmanager.yml
     volumes:
@@ -51,7 +57,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.alertmanager.rule: "Host(`{{ alertmanager_host }}`)"
       traefik.http.routers.alertmanager.entrypoints: websecure
-      traefik.http.routers.alertmanager.tls.certresolver: cloudflare
+      traefik.http.routers.alertmanager.tls.certresolver: letsencrypt
       traefik.http.services.alertmanager.loadbalancer.server.port: "9093"
     networks:
       - {{ docker_network_name }}
@@ -60,6 +66,8 @@ services:
     image: {{ node_exporter_image }}
     container_name: node-exporter
     restart: unless-stopped
+    ports:
+      - "9100:9100"
     command:
       - --path.rootfs=/host
     volumes: