Pin Docker image versions and fix config drift

- Pin all :latest tags to specific versions for reproducibility:
  jellyfin→10.11.6, gitea→1.24, portainer→2.39.0, qbittorrent→5.1.4
- Fix nextcloud config drift: repo had :29, live was running :32
- Fix qbittorrent: remove user: directive (breaks s6-overlay init)
- Fix portainer: remove healthcheck (distroless image has no shell)

config/docker/qbittorrent/docker-compose.yml

@@ -11,7 +11,7 @@
 
 services:
   qbittorrent:
-    image: linuxserver/qbittorrent:latest
+    image: linuxserver/qbittorrent:5.1.4
     container_name: qbittorrent
     restart: unless-stopped
 
@@ -23,7 +23,7 @@ services:
       - WEBUI_PORT=8080
 
     # Security hardening
-    user: "1000:1000"
+    # NOTE: No user: directive — linuxserver uses s6-overlay (starts as root, drops to PUID/PGID)
     read_only: false  # qBittorrent needs write access for downloads
     tmpfs:
       - /tmp:noexec,nosuid,size=100m