feat(homelab): isolate PR runner and add Paperless

.gitea/runner/pr-runner.service

@@ -1,11 +1,12 @@
 [Unit]
 Description=Gitea Actions untrusted pull request runner
-After=network-online.target
-Wants=network-online.target
+After=network-online.target docker.service
+Wants=network-online.target docker.service
 
 [Service]
 User=gitea-pr-runner
 Group=gitea-pr-runner
+SupplementaryGroups=docker
 WorkingDirectory=/var/lib/gitea-pr-runner
 Environment=HOME=/var/lib/gitea-pr-runner
 Environment=PATH=/var/lib/gitea-pr-runner/.cache/homelab-ci/bin:/usr/local/bin:/usr/bin:/bin