dankserver: jellyfin GPU device via AddDevice=, seam guard for Device=

The podman 5.x v1 quadlet generator rejected the whole jellyfin unit on
the unsupported Device= key (generator log: unsupported key 'Device' in
group 'Container'), so no jellyfin.service was generated and the cutover
restart failed with 'Unit not found' after the data root had already
migrated cleanly. gluetun proves AddDevice= is the house key. New seam
test denies Device= across all six dankserver units and pins the
AddDevice=/dev/dri replacement.

dankserver/jellyfin/quadlet/jellyfin.container

@@ -43,7 +43,7 @@ Volume=/home/dank/Containers/jellyfin/config:/config
 Volume=/home/dank/Containers/jellyfin/cache:/cache
 Volume=/mnt/entropy/Movies:/data/movies:ro
 Volume=/mnt/entropy/TVShows:/data/shows:ro
-Device=/dev/dri
+AddDevice=/dev/dri
 GroupAdd=keep-groups
 HealthCmd=curl -f http://localhost:8096/health
 HealthInterval=30s