bf1a8ca3

By: ananjiani <ananjiani@noreply.codeberg.org>

feat(jellyfin): host media archive on theoden, fronted by traefik (#317)

Native `services.jellyfin` on theoden (LAN-only; nixarr jellyfin extras not needed). Romm-pattern off-cluster Service+Endpoints to 192.168.1.27:8096, bifrost-pattern dual IngressRoute + certs: `jellyfin.lan` (lan-ca) and `jellyfin.dimensiondoor.xyz` (letsencrypt, tailscale-reachable). AdGuard rewrite for jellyfin.lan. kodi-gbm + jellyfin addon on rivendell. Replaces stale `media` DNS record. Leftover junk dirs removed on theoden.

After merge: tofu apply (terraform/), jellyfin wizard at https://jellyfin.lan, Kodi addon pairing.

Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/317