feat(deploy)!: Jellyfin on halkyon.li as the sidecar, ADR 0032's home end gone (ADR 0039, D15)

The Jellyfin sidecar takes its library from a folder on the host where .env
names one (JELLYFIN_MEDIA, read-only), else from deploy/jellyfin/media as
before. On halkyon.li that is /data/media: the library moves out of the
developer's home, which Jellyfin's own user can't enter. The sidecar README
says how the home end's configuration, accounts and libraries move in, with
its network settings corrected for Caddy before it starts.

BREAKING CHANGE: compose.jellyfin-home.yaml, deploy/home-jellyfin/ and
jellyfin.caddy's JELLYFIN_UPSTREAM are gone with ADR 0032, whose server end
retires with learn.halkyon.eu's server; it was never brought up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0039-halkyon-li-at-home.md

@@ -136,10 +136,16 @@
   `halkyon_meditate` database under a role of its own, a member of the register,
   `redeploy.sh` and `backup.sh` taking it in.
 - **D15 Jellyfin as the instance's sidecar** (`compose.jellyfin.yaml`), on `edge` beside
-  Caddy, the library mounted read-only from `/home/raisondetredev/Media`; its existing
-  configuration (`deploy/home-jellyfin/jellyfin/config`) moves with it, so its accounts
-  and library stay. `deploy/home-jellyfin/` and `compose.jellyfin-home.yaml` go, with
-  ADR 0032's open question.
+  Caddy, with its existing configuration (`deploy/home-jellyfin/jellyfin/config`), so its
+  accounts and libraries stay. Its library is mounted read-only from the host
+  (`JELLYFIN_MEDIA`). Found while building: it can't stay in
+  `/home/raisondetredev/Media`, as the developer's home is closed to other users and
+  Jellyfin runs as its own (61096). So it moves to `/data/media` (a rename on one
+  filesystem, `/home` being a bind mount of `/data/home`), readable by all, over opening
+  the home to every user. ADR 0032's network settings (LAN `172.29.96.1/32`, proxy
+  `10.61.96.1`) are set to the sidecar's before it starts, as they would count the
+  admin's requests as remote and lock them out. `deploy/home-jellyfin/` and
+  `compose.jellyfin-home.yaml` go, with ADR 0032's open question.
 - **D16 The runner on balthasar**: `deploy/runner/`'s unit as it is (its own user, no
   `/home`, no Docker socket, Docker's networks denied), with these changes:
   - its folder on the HDD outside `/home`;