security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)

watchtower/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     environment:
       - WATCHTOWER_POLL_INTERVAL=300
       - WATCHTOWER_CLEANUP=true
-      - WATCHTOWER_NOTIFICATION_URL=telegram://8585007357:AAHtiEFm30Mpg6zl_1hww-BAWPXWu9GsDB0@telegram?chats=8444709468
+      - WATCHTOWER_NOTIFICATION_URL=telegram://${TELEGRAM_BOT_TOKEN}@telegram?chats=${TELEGRAM_CHAT_ID}
     labels:
       - com.centurylinklabs.watchtower.enable=false
     restart: unless-stopped