feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)

The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.

On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/home-jellyfin/server/wg-jellyfin.conf

@@ -0,0 +1,17 @@
+# The instance's end of the tunnel to Jellyfin at home (ADR 0032, D4), as
+# /etc/wireguard/wg-jellyfin.conf on the instance's server (root, 0600), brought up by
+# wg-quick@wg-jellyfin. Its private key is a file of its own beside it, never here.
+# Setting it up: sidecars/README.md, *Jellyfin at home*.
+
+[Interface]
+Address = 10.61.96.1/30
+ListenPort = 51820
+PostUp = wg set %i private-key /etc/wireguard/wg-jellyfin.key
+# Caddy alone through the tunnel, nothing of the host from it (D5).
+PostUp = /etc/wireguard/wg-jellyfin-rules.sh up %i
+PreDown = /etc/wireguard/wg-jellyfin-rules.sh down %i
+
+# The home end, which dials in: no endpoint, so this server never names its address.
+[Peer]
+PublicKey = <the home end's public key>
+AllowedIPs = 10.61.96.2/32