feat(deploy)!: Jellyfin on halkyon.li as the sidecar, ADR 0032's home end gone (ADR 0039, D15)

The Jellyfin sidecar takes its library from a folder on the host where .env
names one (JELLYFIN_MEDIA, read-only), else from deploy/jellyfin/media as
before. On halkyon.li that is /data/media: the library moves out of the
developer's home, which Jellyfin's own user can't enter. The sidecar README
says how the home end's configuration, accounts and libraries move in, with
its network settings corrected for Caddy before it starts.

BREAKING CHANGE: compose.jellyfin-home.yaml, deploy/home-jellyfin/ and
jellyfin.caddy's JELLYFIN_UPSTREAM are gone with ADR 0032, whose server end
retires with learn.halkyon.eu's server; it was never brought up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.jellyfin.yaml

@@ -6,7 +6,9 @@
 #   JELLYFIN_DOMAIN=jellyfin.example.org
 #
 # Its files are the server's, in ./jellyfin (config, cache, media), owned by a user ID
-# of its own, which no person, no other container and not the CI runner uses: processes
+# of its own; or the media in a folder elsewhere on the host that .env names
+# (JELLYFIN_MEDIA, readable by all: halkyon.li's /data/media, ADR 0039, D15). The user ID
+# is one no person, no other container and not the CI runner uses: processes
 # of one user ID can read each other's environment and files. Setting it up, and the
 # demo account: sidecars/README.md.
 
@@ -21,7 +23,7 @@ services:
     volumes:
       - ./jellyfin/config:/config
       - ./jellyfin/cache:/cache
-      - ./jellyfin/media:/media:ro
+      - ${JELLYFIN_MEDIA:-./jellyfin/media}:/media:ro
     # On `edge` alone, beside Caddy and the server's public API, never beside Postgres;
     # no published port. A fixed address, for the admin's SSH tunnel (sidecars/README.md).
     networks: