infra: 2026-10-26 version audit, upgrades, UniFi re-removal

- Synapse v1.163.2, MAS 1.27.1, Traefik v3.7, node-exporter v1.12.1 (all
  nodes), cadvisor -> ghcr.io v0.60.6, alertmanager-receiver 2026.9.23,
  Gitea 1.26.4, Jellyfin 12.3, Seerr v3.5.1
- Watchtower -> nickfedor/watchtower fork, twice daily (04:00/16:00)
- Monitoring legacy node-exporter gated behind a compose profile
- unifi-os-server on .100 removed again; compose file renamed so it
  cannot be revived
- CLAUDE.md: Known Issues #40-43, service tree updates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQhgEUqcaV4WM2S4hfXgHD

compose/bart/media/docker-compose.yml

@@ -1,11 +1,10 @@
 services:
   jellyfin:
-    # PINNED to the 12.0.0 unstable build that migrated the DB to the v12
-    # schema (DropExtraIdsColumn) — :latest is still 10.11.x and CANNOT read
-    # this DB ("no such column: b.ExtraIds"). Do not unpin until official
-    # stable >= 12 ships. (2026-07-14: a :latest deploy downgraded it and
-    # broke Resume/home sections; repinned.)
-    image: jellyfin/jellyfin:2026060106
+    # Pinned to official stable 12.2. History: ran the 2026060106 unstable
+    # build from 2026-07-14 because the DB had been migrated to the v12 schema
+    # and 10.11.x could not read it. Stable 12 shipped 2026-09; moved to
+    # 12.2 on 2026-10-17, 12.3 on 2026-10-26. Never go back below 12.
+    image: jellyfin/jellyfin:12.3.20261023-013714
     container_name: jellyfin
     restart: unless-stopped
     environment:
@@ -145,14 +144,19 @@ services:
         max-size: "50m"
         max-file: "3"
 
-  jellyseerr:
-    image: fallenbagel/jellyseerr:latest
-    container_name: jellyseerr
+  seerr:
+    # Seerr = merged successor of Jellyseerr/Overseerr (fallenbagel/jellyseerr
+    # is deprecated). Migrated 2026-10-17; DB auto-migrated on first start.
+    # Runs as node (UID 1000), needs init. LOCAL disk (SQLite). Old config left
+    # at /mnt/docker-data/configs/jellyseerr for rollback.
+    image: seerr/seerr:v3.5.1
+    init: true
+    container_name: seerr
     restart: unless-stopped
     environment:
       - TZ=America/Chicago
     volumes:
-      - /mnt/docker-data/configs/jellyseerr:/app/config
+      - /var/lib/seerr:/app/config
     ports:
       - "5055:5055"
     mem_limit: 512M

compose/bart/node-exporter/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   node-exporter:
-    image: prom/node-exporter:v1.7.0
+    image: prom/node-exporter:v1.12.1
     container_name: node-exporter
     hostname: bart
     network_mode: host
@@ -11,14 +11,14 @@ services:
       - /sys:/host/sys:ro
       - /:/rootfs:ro
     command:
-      - '--path.procfs=/host/proc'
-      - '--path.rootfs=/rootfs'
-      - '--path.sysfs=/host/sys'
-      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
+      - "--path.procfs=/host/proc"
+      - "--path.rootfs=/rootfs"
+      - "--path.sysfs=/host/sys"
+      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
     logging:
-      driver: "json-file"
+      driver: json-file
       options:
-        max-size: "50m"
+        max-size: 50m
         max-file: "3"
     labels:
-      - "com.centurylinklabs.watchtower.enable=false"
+      - com.centurylinklabs.watchtower.enable=false

compose/bart/watchtower/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   watchtower:
-    image: containrrr/watchtower:latest
+    image: nickfedor/watchtower:latest  # containrrr/watchtower is archived upstream (2026-10-26)
     container_name: watchtower
     restart: unless-stopped
     volumes:
@@ -8,7 +8,7 @@ services:
     environment:
       - WATCHTOWER_CLEANUP=true
       - WATCHTOWER_INCLUDE_RESTARTING=true
-      - WATCHTOWER_POLL_INTERVAL=86400
+      - WATCHTOWER_SCHEDULE=0 0 4,16 * * *  # twice daily, 04:00 + 16:00 local
       - WATCHTOWER_MONITOR_ONLY=false
       - TZ=America/Chicago
       - DOCKER_API_VERSION=1.44