dankserver: jellyfin GPU device via AddDevice=, seam guard for Device=

The podman 5.x v1 quadlet generator rejected the whole jellyfin unit on
the unsupported Device= key (generator log: unsupported key 'Device' in
group 'Container'), so no jellyfin.service was generated and the cutover
restart failed with 'Unit not found' after the data root had already
migrated cleanly. gluetun proves AddDevice= is the house key. New seam
test denies Device= across all six dankserver units and pins the
AddDevice=/dev/dri replacement.

dankserver/jellyfin/quadlet/jellyfin.container

@@ -43,7 +43,7 @@ Volume=/home/dank/Containers/jellyfin/config:/config
 Volume=/home/dank/Containers/jellyfin/cache:/cache
 Volume=/mnt/entropy/Movies:/data/movies:ro
 Volume=/mnt/entropy/TVShows:/data/shows:ro
-Device=/dev/dri
+AddDevice=/dev/dri
 GroupAdd=keep-groups
 HealthCmd=curl -f http://localhost:8096/health
 HealthInterval=30s

tests/dankserver_quadlet.bats

@@ -43,3 +43,16 @@ load helpers
     grep -q '^Network=dankserver_appnet:alias=redis$' \
         "$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1
 }
+
+@test "no unit uses the unsupported Device= key (v1 generator needs AddDevice=)" {
+    # A rejected file kills its own unit silently: the deploy would then die
+    # with "Unit jellyfin.service not found" only on the target. Device= was
+    # the first offender (jellyfin GPU passthrough); Command= is guarded
+    # above. Keep this list current with every generator finding.
+    for unit in dankserver/romm/quadlet/romm dankserver/romm/quadlet/romm-mariadb \
+                dankserver/romm/quadlet/romm-redis dankserver/jellyfin/quadlet/jellyfin \
+                dankserver/calibre-web/quadlet/calibre-web dankserver/copyparty/quadlet/copyparty; do
+        ! grep -q '^Device=' "$REPO_ROOT/$unit.container" || return 1
+    done
+    grep -q '^AddDevice=/dev/dri$' "$REPO_ROOT/dankserver/jellyfin/quadlet/jellyfin.container" || return 1
+}