Bump pinned images to latest: authentik 2026.8.3, tautulli ls245, calibre-web ls402, plex 1.43.4

- authentik 2026.8.0 -> 2026.8.3 (server, worker, outpost quadlets)
- tautulli v2.18.1-ls242 -> v2.18.1-ls245
- calibre-web 0.6.27-ls397 -> 0.6.27-ls402
- plex 1.43.3.10896-ls322 -> 1.43.4.10903-ls325
- seerr already at v3.4.1 (latest, no bump)
- sync docs + the dead compose.yaml plex entry

anubis is already at the latest stable (v1.27.0); only pre-releases exist
beyond it, so no stable bump. Local-build images (caddy, alloy, loki,
comfyui, hermes) are refreshed by forced --no-cache rebuilds, not pins.

serverAppConfigs-docs/Dankserver/Calibre-Web.md

@@ -19,7 +19,7 @@ vhost — Calibre-Web serves its own login; direct proxy to
 
 | Item | Value |
 |------|-------|
-| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls397` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) |
+| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls402` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) |
 | Network | `pasta` (the default rootless-podman userslide network); only 8083 is host-published |
 | Base OS | Ubuntu Noble (24.04 LTS, since 2024-12-05) |
 | Port | 8083 (host) → 8083 (container) |
@@ -69,7 +69,7 @@ Deployment since 2026-09-01 is a quadlet unit
 (`dankserver/calibre-web/quadlet/calibre-web.container` →
 `calibre-web.service`, deploy with
 `./scripts/deploy.sh dankserver --service calibre-web`), image pinned to
-`0.6.27-ls397`, healthcheck on `/`, `PublishPort=8083:8083`. This service was
+`0.6.27-ls402`, healthcheck on `/`, `PublishPort=8083:8083`. This service was
 already on the Containers data-root layout before the standardization, so the
 cutover was a bare-container retire + unit start with no data movement.
 
@@ -78,7 +78,7 @@ cutover was a bare-container retire + unit start with no data movement.
 ```yaml
 services:
   calibre-web:
-    image: lscr.io/linuxserver/calibre-web:0.6.27-ls397
+    image: lscr.io/linuxserver/calibre-web:0.6.27-ls402
     container_name: calibre-web
     restart: unless-stopped
     environment:

serverAppConfigs-docs/Dankserver/Plex.md

@@ -24,7 +24,7 @@ public traffic can be fronted by Caddy like every other vhost.
 | Item | Value |
 |------|-------|
 | Runtime | podman quadlet, `plex.service` (user manager) — migrated from the native `plexmediaserver.service` OS-package unit (2026-09) |
-| Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
+| Image | `lscr.io/linuxserver/plex:1.43.4.10903-e5521bd8c-ls325` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
 | Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes |
 | Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan |
 | Identity | fleet rootless model — container root maps to the `dank` user (1000:1000); the deployer chowns the data root on first cutover |

serverAppConfigs-docs/Dankserver/Tautulli.md

@@ -23,7 +23,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`).
 | Item | Value |
 |------|-------|
 | Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
-| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
+| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls245` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
 | Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
 | Identity | fleet rootless model — container root maps to the `dank` user (1000:1000) |
 | Port | `8181/tcp` published on `0.0.0.0` |