security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)

glances/docker-compose.yaml

@@ -3,9 +3,8 @@ services:
     container_name: glances
     image: 'nicolargo/glances:ubuntu-latest-full'
     restart: unless-stopped
-    privileged: true
     ports:
-      - 61208-61209:61208-61209
+      - 127.0.0.1:61208-61209:61208-61209
     environment:
       - TZ=${TZ}
       - NVIDIA_VISIBLE_DEVICES=all