feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network

An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.

The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.jellyfin.yaml

@@ -0,0 +1,44 @@
+# The Jellyfin sidecar (decided 2026-10-14): a Jellyfin server beside the instance, which
+# people watch and listen to learn from (Halkyon Learn's Watch screen), suggested to them
+# by the instance. Switched on in .env, with the domain it answers at:
+#
+#   COMPOSE_FILE=compose.yaml:compose.jellyfin.yaml
+#   JELLYFIN_DOMAIN=jellyfin.example.org
+#
+# Its files are the server's, in ./jellyfin (config, cache, media), owned by a user ID
+# of its own, which no person, no other container and not the CI runner uses: processes
+# of one user ID can read each other's environment and files. Setting it up, and the
+# demo account: sidecars/README.md.
+
+services:
+  jellyfin:
+    # v12.2, the version Halkyon Learn's Jellyfin feature is checked with.
+    image: jellyfin/jellyfin@sha256:357724bf0ae27a672c7cbaa899db2d9abeb13dbd8657ccce750258a4c059d037
+    restart: unless-stopped
+    user: "61096:61096"
+    environment:
+      JELLYFIN_PublishedServerUrl: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
+    volumes:
+      - ./jellyfin/config:/config
+      - ./jellyfin/cache:/cache
+      - ./jellyfin/media:/media:ro
+    # On `edge` alone, beside Caddy and the server's public API, never beside Postgres;
+    # no published port. A fixed address, for the admin's SSH tunnel (sidecars/README.md).
+    networks:
+      edge:
+        ipv4_address: 172.30.80.10
+    # Videos stream as stored (the app asks for static=true): nothing is transcoded.
+    mem_limit: 768m
+    logging:
+      driver: journald
+
+  caddy:
+    environment:
+      JELLYFIN_DOMAIN: ${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
+    volumes:
+      - ./sidecars/jellyfin.caddy:/etc/caddy/sidecars/jellyfin.caddy:ro
+
+  server:
+    environment:
+      # The instance suggests this Jellyfin, rather than looking for one.
+      JELLYFIN_URL: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}/