fix: recover from 2026-07-12 power-event fallout + efficiency cleanup

- gitea: LevelDB queues -> local /var/lib/gitea-queues (stale NFS lock, 7,972-restart loop)
- semaphore-db: data -> local /var/lib/semaphore-db (stale ibdata1 NFS lock, 975 restarts)
- sonarr: config -> local /var/lib/sonarr (SQLite-on-NFS migration crash)
- nzbhydra2: mem_limit 768M -> 1G (was pinned at limit, unhealthy)
- jellyfin: deploy pending VAAPI device passthrough (i965/renderD128)
- openvas: disable Watchtower (latest major pull forced pg_upgrade crash-loop)
- onyx: fully decommissioned (down since ~June 8 unnoticed)
- remove duplicate monitoring/traefik/guacamole stacks from .100, failover guacamole from bart
- synapse: raise rc_message (alertmanager receiver was 429-limited; alerts silently dropped for weeks)
- prometheus: UniFi probe 8443 -> 11443, solo.hobbs.farm via 401-tolerant module, drop onyx target
- frigate restart cron: unwritable /var/log path meant it never ran; now 4x daily to ~glyptic
- CLAUDE.md: document all of the above + AdGuard broken/unconfigured since 2026-05-17

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compose/bart/openvas/docker-compose.yml

@@ -3,6 +3,10 @@ services:
     image: immauss/openvas:latest
     container_name: openvas
     restart: unless-stopped
+    labels:
+      # Watchtower pulled a new major that forced a pg_upgrade crash-loop
+      # (212 restarts, 2026-07-13); update OpenVAS deliberately instead
+      - "com.centurylinklabs.watchtower.enable=false"
     environment:
       - PASSWORD=${OPENVAS_PASSWORD}
       - USERNAME=${OPENVAS_USERNAME}