AMillionMonkeys

I use Lemmy logged-in on my computer to post and interact, but I read it logged-out on my phone to get a feel for what people are talking about outside of my interests.
Unfortunately, the communities I've entered in the block list still show up in the feed.
What gives?

Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn't really think about it when I started. I make a half-assed effort at security where I don't use "admin" or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I'm running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what's the threat model? Is there an easier way?

It's extremely time-, storage-, and compute-expensive to generate images for an entire library before-hand. In my case it's doing all this work for tons of content that I might not even watch again.
I guess the idea is that there's no delay in the images being available as soon as the programme is started?
I'm not sure the trade-off is worth it.

I'm running a new installation of the server and LibreELEC (this worked fine on my previous installs, but I decided to fix what ain't broke).
I'm casting over the LAN from the server on Debian to LibreElec on a Rraspberry Pi.
The problem I'm encountering now is that LibreElec will hang and show a spinner for anywhere from 15 seconds to several minutes when advancing to the next track of an album or music playlist. It only breaks when I'm casting, not when I'm playing locally through the Player. It only breaks for FLAC files, not Mp3s, so transcoding seems to have something to do with it.
I've disabled playback of transcoded audio in the user's settings and restarted the server, but it didn't change anything.

Where should I be looking to figure this out?

I've noticed that some of the game day bots for baseball communities post with a "bot account" flag, but when creating an account I don't see a checkbox anywhere or anything.