owncloud: document and fix organize_photos.sh folder structure

- Add full header doc block explaining purpose, patterns, and scheduling
- Inline comments on all functions and both processing passes
- Fix folder format: YYYY/YYYY-MM/ → YYYY/MM/ (year was redundant in subfolder)
- Add pass 2: migrate existing YYYY/YYYY-MM/ folders to YYYY/MM/
- Pass 1 now also handles Android-app pre-sorted YYYY/MM/ videos correctly

Also commit pending doc updates:
- README.md: remove Kopia stack, add ntfy entry, fix infrastructure.caddy note
- authentik/SETUP-GUIDE.md: add Mealie OIDC setup notes
- homelab-overview.md: remove Kopia refs, add Vaultwarden, fix TrueNAS/PBS wording

authentik/SETUP-GUIDE.md

@@ -193,6 +193,27 @@ WEB_OIDC_CLIENT_ID=<client id>
 
 ---
 
+#### Mealie (`recipes.jgitta.com`)
+
+**Redirect URIs**: `https://recipes.jgitta.com/login` and `https://recipes.jgitta.com/login?direct=1`
+
+Set in the Mealie stack (Portainer stack 59, `siklos/mealie/docker-compose.yml` in Gitea):
+```
+OIDC_AUTH_ENABLED=true
+OIDC_SIGNUP_ENABLED=true
+OIDC_CONFIGURATION_URL=https://auth.jgitta.com/application/o/mealie/.well-known/openid-configuration
+OIDC_CLIENT_ID=<client id>
+OIDC_CLIENT_SECRET=<client secret>
+OIDC_PROVIDER_NAME=Authentik
+OIDC_AUTO_REDIRECT=false
+OIDC_REMEMBER_ME=true
+```
+Client ID/secret and the Authentik API token used to create this provider are in API Codes.md.
+
+Mealie links accounts by email, so the existing Mealie admin account (`jgitta`) had its email changed to `admin@jgitta.com` to match the Authentik `akadmin` account — otherwise the first OIDC login would have created a brand-new, empty Mealie account instead of linking to the one with all the recipes. Password login (`ALLOW_PASSWORD_LOGIN`, default true) was left enabled as a fallback.
+
+---
+
 #### Home Assistant (`ha.jgitta.com`, VM106)
 
 **Redirect URI**: `https://ha.jgitta.com/auth/oidc/callback`