fix: recover from 2026-07-12 power-event fallout + efficiency cleanup

- gitea: LevelDB queues -> local /var/lib/gitea-queues (stale NFS lock, 7,972-restart loop)
- semaphore-db: data -> local /var/lib/semaphore-db (stale ibdata1 NFS lock, 975 restarts)
- sonarr: config -> local /var/lib/sonarr (SQLite-on-NFS migration crash)
- nzbhydra2: mem_limit 768M -> 1G (was pinned at limit, unhealthy)
- jellyfin: deploy pending VAAPI device passthrough (i965/renderD128)
- openvas: disable Watchtower (latest major pull forced pg_upgrade crash-loop)
- onyx: fully decommissioned (down since ~June 8 unnoticed)
- remove duplicate monitoring/traefik/guacamole stacks from .100, failover guacamole from bart
- synapse: raise rc_message (alertmanager receiver was 429-limited; alerts silently dropped for weeks)
- prometheus: UniFi probe 8443 -> 11443, solo.hobbs.farm via 401-tolerant module, drop onyx target
- frigate restart cron: unwritable /var/log path meant it never ran; now 4x daily to ~glyptic
- CLAUDE.md: document all of the above + AdGuard broken/unconfigured since 2026-05-17

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compose/bart/media/docker-compose.yml

@@ -6,11 +6,17 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
+      - LIBVA_DRIVER_NAME=i965   # Haswell HD 4600 uses legacy i965 (iHD is Broadwell+)
     volumes:
       - /mnt/docker-data/configs/jellyfin:/config
       - /mnt/nas-media:/media
     ports:
       - "8096:8096"
+    devices:
+      - /dev/dri:/dev/dri        # Intel iGPU for VAAPI hardware transcoding
+    group_add:
+      - "993"   # render
+      - "44"    # video
     mem_limit: 2G
     healthcheck:
       test: ["CMD-SHELL", "curl -f http://localhost:8096/health || exit 1"]
@@ -33,7 +39,9 @@ services:
       - PGID=1000
       - TZ=America/Chicago
     volumes:
-      - /mnt/docker-data/configs/sonarr:/config
+      # LOCAL disk, not NFS: SQLite-on-NFS locking crashed Sonarr's DB migration
+      # after the 2026-07-12 power event ("waiting for user intervention")
+      - /var/lib/sonarr:/config
       - /mnt/nas-media:/media
     ports:
       - "8989:8989"
@@ -114,7 +122,7 @@ services:
       - /mnt/docker-data/configs/nzbhydra:/config
     ports:
       - "5076:5076"
-    mem_limit: 768M
+    mem_limit: 1G
     healthcheck:
       test: ["CMD-SHELL", "curl -f http://localhost:5076/ || exit 1"]
       interval: 30s