fix: recover from 2026-07-12 power-event fallout + efficiency cleanup

- gitea: LevelDB queues -> local /var/lib/gitea-queues (stale NFS lock, 7,972-restart loop)
- semaphore-db: data -> local /var/lib/semaphore-db (stale ibdata1 NFS lock, 975 restarts)
- sonarr: config -> local /var/lib/sonarr (SQLite-on-NFS migration crash)
- nzbhydra2: mem_limit 768M -> 1G (was pinned at limit, unhealthy)
- jellyfin: deploy pending VAAPI device passthrough (i965/renderD128)
- openvas: disable Watchtower (latest major pull forced pg_upgrade crash-loop)
- onyx: fully decommissioned (down since ~June 8 unnoticed)
- remove duplicate monitoring/traefik/guacamole stacks from .100, failover guacamole from bart
- synapse: raise rc_message (alertmanager receiver was 429-limited; alerts silently dropped for weeks)
- prometheus: UniFi probe 8443 -> 11443, solo.hobbs.farm via 401-tolerant module, drop onyx target
- frigate restart cron: unwritable /var/log path meant it never ran; now 4x daily to ~glyptic
- CLAUDE.md: document all of the above + AdGuard broken/unconfigured since 2026-05-17

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compose/hf-pdocker-02/semaphore/docker-compose.yml

@@ -53,7 +53,9 @@ services:
       - MYSQL_USER=semaphore
       - MYSQL_PASSWORD=${SEMAPHORE_DB_PASSWORD}
     volumes:
-      - /mnt/docker-data/databases/semaphore-db:/var/lib/mysql
+      # LOCAL disk, not NFS: MySQL on NFS suffers stale-lock and InnoDB corruption
+      # (2026-07-11 corruption, 2026-07-13 stale ibdata1 lock after power event)
+      - /var/lib/semaphore-db:/var/lib/mysql
     networks:
       - semaphore-internal
     labels: