bf1a8ca3

By: ananjiani <ananjiani@noreply.codeberg.org>

feat(jellyfin): host media archive on theoden, fronted by traefik (#317)

Native `services.jellyfin` on theoden (LAN-only; nixarr jellyfin extras not needed). Romm-pattern off-cluster Service+Endpoints to 192.168.1.27:8096, bifrost-pattern dual IngressRoute + certs: `jellyfin.lan` (lan-ca) and `jellyfin.dimensiondoor.xyz` (letsencrypt, tailscale-reachable). AdGuard rewrite for jellyfin.lan. kodi-gbm + jellyfin addon on rivendell. Replaces stale `media` DNS record. Leftover junk dirs removed on theoden.

After merge: tofu apply (terraform/), jellyfin wizard at https://jellyfin.lan, Kodi addon pairing.

Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/317
comin-ci-gate-testsdevshelldocshome-ammars-pchome-framework13nixos-ammars-pcnixos-aragornnixos-boromirnixos-denethornixos-erebornixos-framework13nixos-rivendellnixos-samwisenixos-steamdecknixos-theodennixos-wsl-workpre-commit-checkconfiguredevShellattic-clientdocumentationx86_64-linux