docs: record quadlet standardization of dankserver media + dankclaw data roots

Phase 1/2 of the podman standardization plan: service pages updated to the
quadlet reality (units, Containers data roots, env-file secret convention,
the v1-generator findings each caught live), Storage Policy documents the
two rootless ownership regimes and the merge-move migration, Deployment
Flow's service-manager table no longer claims dankserver media is bare
inventory-only. Bundle change log entry added.

serverAppConfigs-docs/Dankserver/Jellyfin.md

@@ -31,7 +31,7 @@ graph LR
     J --> Cache[Jellyfin cache]
 ```
 
-## Docker Compose
+## Docker Compose (reference — retired 2026-09-01; live mounts use `/home/dank/Containers/jellyfin`, see Deployment below)
 
 ```yaml
 services:
@@ -82,11 +82,23 @@ Set **Base URL** to `/` (or the path you configure) in Jellyfin Dashboard → Ne
 
 | Mount | Purpose | Size Estimate |
 |-------|---------|---------------|
-| `/opt/jellyfin/config` | SQLite database, settings, cached images | 10–100 GB |
-| `/opt/jellyfin/cache` | Transcoding segments, extracted posters | Self-cleaning per session |
+| `/home/dank/Containers/jellyfin/config` | SQLite database, settings, cached images | 10–100 GB |
+| `/home/dank/Containers/jellyfin/cache` | Transcoding segments, extracted posters | Self-cleaning per session |
+| `/mnt/entropy/Movies`, `/mnt/entropy/TVShows` | Media, **read-only binds** (`:ro`) — no automated write path | — |
 
 The database must be on local storage (SSD/NVMe preferred). Media libraries can be on NFS/mergerfs. If media is on NFS, set `DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true`.
 
+## Deployment (Quadlet)
+
+Since 2026-09-01: `dankserver/jellyfin/quadlet/jellyfin.container` →
+`jellyfin.service` (generator-enabled), deployed with
+`./scripts/deploy.sh dankserver --service jellyfin`. GPU passthrough uses
+`AddDevice=/dev/dri` — plain `Device=` is **not** a quadlet key and makes the
+v1 generator reject the whole unit (learned live: "unsupported key 'Device'
+in group 'Container'"). Entropy mounts stay `:ro`; the container runs as
+root inside the user namespace, so the render-node ACLs apply via the device
+cgroup regardless of `GroupAdd=keep-groups`.
+
 ## Authentication
 
 - **Built-in auth (default):** Per-user libraries, parental controls, max bitrate limits. Manage via Dashboard → Users.
@@ -147,7 +159,7 @@ Run Jellyfin alongside Plex for an incremental migration. Point Jellyfin at the
 
 1. Verify GPU on host: `ls -l /dev/dri/`, `lspci | grep -i vga`, `getent group render`.
 2. Install media drivers: `sudo apt install intel-media-va-driver-non-free vainfo intel-gpu-tools`.
-3. Create directories: `/opt/jellyfin/config`, `/opt/jellyfin/cache`.
+3. Create directories: `/home/dank/Containers/jellyfin/config`, `/home/dank/Containers/jellyfin/cache`.
 4. Write compose file, verify device and GID.
 5. Deploy: `podman compose up -d`.
 6. Test GPU passthrough: `podman exec jellyfin /usr/lib/jellyfin-ffmpeg/vainfo --display drm --device /dev/dri/renderD128`.