Restructure compose mirror: stacks/ grouped by purpose, not by host

Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/
with a single stacks/ tree grouped by function (identity-and-security,
platform, media, productivity, dev-tools) - 55 stacks total, every one
a real directory in the private repos today.

Resolves all outstanding drift: adds Wazuh (previously entirely
missing), Firefly III and Postiz (never mirrored), the internal-zone
Caddy instance and the Cron Scheduler's separate NocoDB instance
(both previously conflated with their counterparts under one shared
folder); renames Calibre-Web to calibre-web-automated and splits
Kodi-MariaDB into kodi + mariadb-latest to match what the private
repos actually run now; drops the decommissioned NetBox stack.

Also removes automation/iac/old-content/ and
automation/ansible/old-playbooks/ in the same pass - both folders
were entirely stale content describing a superseded architecture
(GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current
Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.

stacks/media/kodi/docker-compose.yaml

@@ -0,0 +1,56 @@
+services:
+  mariadb:
+    image: mariadb:latest
+    container_name: kodi-mariadb
+    env_file:
+      - .env.secrets   # MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — never committed
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - MYSQL_USER=${MYSQL_USER}
+    volumes:
+      - /path/to/kodi-mariadb:/config
+    ports:
+      - ${HTTP_PORT}:3306
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+  # A small custom bridge service, not an off-the-shelf image - polls Kodi's
+  # own API and keeps a separate media-library tool's watch-state in sync.
+  kodi-ma-bridge:
+    image: python:3.13-slim
+    container_name: kodi-ma-bridge
+    restart: unless-stopped
+    working_dir: /app
+    volumes:
+      - ./bridge.py:/app/bridge.py:ro
+      - ./requirements.txt:/app/requirements.txt:ro
+    command: sh -c "pip install --no-cache-dir -r requirements.txt && python bridge.py"
+    env_file:
+      - .env.secrets   # KODI_PASSWORD, MA_API_TOKEN — never committed
+    environment:
+      - TZ=${TZ}
+      - MA_BASE_URL=${MA_BASE_URL}
+      - KODI_USER=${KODI_USER}
+      - KODI_INSTANCES=${KODI_INSTANCES}
+      - POLL_INTERVAL_SECONDS=${POLL_INTERVAL_SECONDS}
+      - REFILL_THRESHOLD=${REFILL_THRESHOLD}
+      - REFILL_COUNT=${REFILL_COUNT}
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true