docs(deploy): the Jellyfin demo's account never locks

With Jellyfin's default of three failed tries, anyone could switch the
demo off with three wrong passwords; an account without a password has
nothing for the lockout to guard. The runbook also says how people sign
in to it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/README.md

@@ -84,7 +84,11 @@ Steps, in order; ✱ marks a step as root.
    - For a demo, Dashboard › Users › **+**: an account without a password, shown on
      login screens, seeing the demo's library alone; off: playback and conversion that
      need transcoding, content downloading, remote control of other users, deleting
-     media.
+     media. On its Profile tab, **Failed login tries before user is locked out** `-1`:
+     with Jellyfin's default of 3, anyone could switch the demo off with three wrong
+     passwords, and without a password the lockout guards nothing. People sign in to it
+     by tapping it and leaving the password empty: Jellyfin doesn't say which accounts
+     have none.
 
 7. **Check from outside** (anyone, anywhere): `https://<domain>/System/Info/Public`
    answers, `/Users/Public` lists the demo account, a `POST` to `/Users/Password` gets