owncloud: document and fix organize_photos.sh folder structure

- Add full header doc block explaining purpose, patterns, and scheduling
- Inline comments on all functions and both processing passes
- Fix folder format: YYYY/YYYY-MM/ → YYYY/MM/ (year was redundant in subfolder)
- Add pass 2: migrate existing YYYY/YYYY-MM/ folders to YYYY/MM/
- Pass 1 now also handles Android-app pre-sorted YYYY/MM/ videos correctly

Also commit pending doc updates:
- README.md: remove Kopia stack, add ntfy entry, fix infrastructure.caddy note
- authentik/SETUP-GUIDE.md: add Mealie OIDC setup notes
- homelab-overview.md: remove Kopia refs, add Vaultwarden, fix TrueNAS/PBS wording

README.md

@@ -44,7 +44,6 @@ All stacks are managed via **Portainer** at http://192.168.88.27:9000 (or https:
 | guacamole | 8080 | /srv/docker/guacamole | apache.jgitta.com | Apache Guacamole — remote desktop gateway |
 | homarr | 7575 | /srv/docker/homarr/.homarr/appdata | homarr.jgitta.com | Dashboard |
 | karakeep | 3010 | /srv/docker/karakeep | notes.jgitta.com | Bookmarks / read-later |
-| kopia | 51515 | /srv/docker/kopia | kopia.jgitta.com | Backup tool (backs up to TrueNAS) |
 | linkwarden | 3015 | /srv/docker/linkwarden/pgdata | links.jgitta.com | Link manager |
 | litellm | 4000 | /srv/docker/litellm | — | LLM API gateway |
 | meshcentral | 444 | /srv/docker/meshcentral | mesh.jgitta.com | Remote management |
@@ -53,6 +52,7 @@ All stacks are managed via **Portainer** at http://192.168.88.27:9000 (or https:
 | pihole | host network | /srv/docker/pihole | pihole.jgitta.com | DNS ad blocker + faster-whisper + open-webui |
 | portainer | 9000, 9443 | /srv/docker/portainer | portainer.jgitta.com | Container management UI |
 | uptime-kuma | 3001 | /srv/docker/uptime-kuma/data | status.jgitta.com | Uptime monitoring |
+| ntfy | 2586 | /srv/docker/ntfy | ntfy.jgitta.com | Push notifications (replaces Telegram); topic: homelab-alerts; Caddy needs `transport http { versions 1.1 }` for WebSocket |
 | searxng | 8092 | /srv/docker/searxng | search.jgitta.com | Private search engine |
 | watchtower | — | — | — | Auto-updates containers |
 | wordpress | 8095 | /srv/docker/wordpress | jgitta.com | WordPress site |
@@ -94,7 +94,7 @@ Config location: `/etc/caddy/` on the caddy VM.
 |---|---|
 | `Caddyfile` | Main file — sets global options, imports snippets and sites |
 | `snippets.caddy` | Reusable blocks: `web_secure`, `internal_only`, `proxy_timeouts`, etc. |
-| `sites/infrastructure.caddy` | Management/tool services (portainer, kopia, beszel, pihole, etc.) |
+| `sites/infrastructure.caddy` | Management/tool services (portainer, beszel, pihole, etc.) |
 | `sites/media.caddy` | Media and automation stack (jellyfin, sonarr, radarr, next, etc.) |
 | `sites/homenet.caddy` | Internal `.homenet` HTTP-only domains (no TLS) |
 | `sites/goldengamer.caddy` | goldengamer.org external domain |
@@ -121,15 +121,6 @@ Old compose files were renamed to `.bak` after migration to Portainer.
 
 **2026-07-03 — external stacks converted to Portainer:** authentik (stack 58), beszel (57), searxng (56) were created in Portainer; watchtower (18), karakeep (21), frigate (31), immich (45) were redeployed so Portainer owns the running containers. Frigate and immich stack definitions were updated to match the newer host compose files (frigate: cpuset pinning + 8G memory limit; immich: /mnt/immich-photos path + vectorchord postgres image). Host compose files renamed to `.bak`. Do not run `docker compose up` from /srv/docker — deploy via Portainer only.
 
-## Kopia Backup Notes (updated 2026-05-07)
-
-Kopia backs up Nextcloud data (VM 103) and other sources to TrueNAS NFS.
-- Cache limit set to 4 GB content + 512 MB metadata (`kopia cache set`)
-- `/tmp` and `/app/logs` are bind-mounted out of the container to prevent overlay2 growth
-- After-snapshot hook pings Uptime Kuma heartbeat at `status.jgitta.com` after each backup
-- If disk fills up again, check `/srv/docker/kopia/tmp/` for leftover verify/restore artifacts
-- Ignore policy active for `/data/.claude` in the Nextcloud data source
-
 ## Portainer Agent Notes
 
 Portainer agents run on jellyfin and jgpc, allowing the central Portainer instance on