feat: align home-lab stack with production standards — pinning, harde…

[JOduMonT]

…ning, docs

Pin all image versions for reproducibility and tracking:

• searxng 2026.9.15-ca4965040, jellyfin 12.1ubu2604-ls49, qbittorrent 5.2.3-libtorrentv1
• changedetection.io 0.60.6, dgtlmoon/sockpuppetbrowser 0.0.3, flaresolverr v3.5.2

Extend container hardening to all services:

• Drop all capabilities by default (cap_drop: [ALL])
• Add back only what entrypoints need (s6-overlay root→user drop dance or nothing)
• Apply security_opt: [no-new-privileges:true] throughout
• Documented in AGENTS.md as mandatory standard #6

Fix MetaMCP secrets handling:

• Force METAMCP_POSTGRES_PASSWORD to ":?must be set" (like BETTER_AUTH_SECRET)
• Prevents weak default fallback to 'm3t4mcp'

Align CI environment seeding:

• Pass --env-file explicitly in ci.yml and smoke-test.yml per-module validation loops
• Fixes silent breakage of metamcp's required-var validation since its merge

Update documentation:

• Add "Pinned Image Versions" and "Container Hardening" sections to README
• Document daily-stars-explorer and browser port mappings in port table
• Add capability hardening standard to AGENTS.md with cap drop/add patterns

Backfill .env.example:

• Add BROWSER_UI_PORT, BROWSER_CDP_PORT, METAMCP_PORT, DAILY_STARS_PORT
• Add BETTER_AUTH_SECRET, METAMCP_POSTGRES_PASSWORD sections

Add daily-stars-explorer service:

• Image ghcr.io/emanuelef/daily-stars-explorer:20260913-1246 (pinned)
• Fully hardened: cap_drop ALL, no cap_add needed
• Bound to 127.0.0.1 with configurable DAILY_STARS_PORT
• Standard resource limits and log rotation

Add MIT license and confirm all CI validation passes.