feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network

An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.

The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/sidecars/jellyfin.caddy

@@ -0,0 +1,17 @@
+# The Jellyfin sidecar's site (compose.jellyfin.yaml).
+{$JELLYFIN_DOMAIN} {
+	# Its demo account (sidecars/README.md) has no password and is everyone's: nobody
+	# may change a user from outside (give it a password, change its settings or its
+	# picture), only sign in. Halkyon Learn writes nothing else under /Users. The setup
+	# wizard is closed too. The admin works through an SSH tunnel, which doesn't pass
+	# here.
+	@userChanges {
+		method POST PUT DELETE
+		path /Users/* /UserImage /UserImage/*
+		not path /Users/AuthenticateByName /Users/AuthenticateWithQuickConnect
+	}
+	respond @userChanges 403
+	respond /Startup/* 403
+
+	reverse_proxy jellyfin:8096
+}