feat(deploy)!: Jellyfin on halkyon.li as the sidecar, ADR 0032's home end gone (ADR 0039, D15)

The Jellyfin sidecar takes its library from a folder on the host where .env
names one (JELLYFIN_MEDIA, read-only), else from deploy/jellyfin/media as
before. On halkyon.li that is /data/media: the library moves out of the
developer's home, which Jellyfin's own user can't enter. The sidecar README
says how the home end's configuration, accounts and libraries move in, with
its network settings corrected for Caddy before it starts.

BREAKING CHANGE: compose.jellyfin-home.yaml, deploy/home-jellyfin/ and
jellyfin.caddy's JELLYFIN_UPSTREAM are gone with ADR 0032, whose server end
retires with learn.halkyon.eu's server; it was never brought up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

test/deploy/jellyfin_sidecar_test.dart

@@ -0,0 +1,59 @@
+import 'dart:io';
+
+import 'package:test/test.dart';
+import 'package:yaml/yaml.dart';
+
+/// The Jellyfin sidecar (decided 2026-10-14), which halkyon.li runs with the
+/// library already on its host (ADR 0039, D15), in place of ADR 0032's home
+/// end, which goes with it.
+void main() {
+  YamlMap services(String path) =>
+      (loadYaml(File(path).readAsStringSync()) as YamlMap)['services']
+          as YamlMap;
+
+  group('its server', () {
+    final jellyfin =
+        services('deploy/compose.jellyfin.yaml')['jellyfin'] as YamlMap;
+
+    test('reads the library read-only, from the host folder .env names or '
+        'its own', () {
+      expect(
+        jellyfin['volumes'],
+        contains(r'${JELLYFIN_MEDIA:-./jellyfin/media}:/media:ro'),
+      );
+    });
+
+    test('runs as its own user ID, on edge alone, publishing no port', () {
+      expect(jellyfin['user'], '61096:61096');
+      expect((jellyfin['networks'] as YamlMap).keys, ['edge']);
+      expect(jellyfin['ports'], isNull);
+    });
+
+    test('names its public address, never a home one', () {
+      expect(
+        (jellyfin['environment'] as YamlMap)['JELLYFIN_PublishedServerUrl'],
+        r'https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}',
+      );
+    });
+  });
+
+  group('its site', () {
+    final site = File('deploy/sidecars/jellyfin.caddy').readAsStringSync();
+
+    test('refuses changes to users and the setup wizard from outside', () {
+      expect(site, contains('respond @userChanges 403'));
+      expect(site, contains('respond /Startup/* 403'));
+    });
+
+    test('proxies to the sidecar alone', () {
+      expect(site, contains('reverse_proxy jellyfin:8096'));
+      expect(site, isNot(contains('JELLYFIN_UPSTREAM')));
+    });
+  });
+
+  test("ADR 0032's home end is gone, its tunnel with it", () {
+    expect(File('deploy/compose.jellyfin-home.yaml').existsSync(), isFalse);
+    expect(File('deploy/home-jellyfin/compose.yaml').existsSync(), isFalse);
+    expect(Directory('deploy/home-jellyfin/server').existsSync(), isFalse);
+  });
+}