refactor(media): mount the view inside /var/lib/media-meta instead of under /mnt

The merged door was /mnt/media, which read like a third volume and split the host
state across two trees. It is now /var/lib/media-meta/view, so the array layer,
the SSD upper layer, the kernel workdir, the reap trash and the merged tree are
one directory — and the mount table gains no new /mnt entry beside the array.

systemd names a mount unit after its ESCAPED path, so the repo copy keeps the
readable name media-meta-view.mount while `install` writes the host file as
var-lib-media\x2dmeta-view.mount; `plan` prints both and the page records them, so
nobody hunts for a unit that "does not exist". install also creates the mount
point itself, because systemd will not.

The seam now additionally pins that the unit's Where= is exactly the path both
containers bind — guard and bind cannot drift apart. The Quadlet Lifecycle
phantom-path example is corrected too: it named an invented /mnt/media/*, while
the real phantom is the legacy /opt/jellyfin/* that dankserver/compose.yaml still
carries for a service whose roots moved to /home/dank/Containers/jellyfin.

scripts/deploy-plan.py

@@ -422,7 +422,7 @@ def services_for_path(path: str, target: str) -> set[str]:
             }
             _add(services, *quadlet_services.get(parts[1], set()))
         if len(parts) >= 2 and parts[1] == "host":
-            # dankserver/host/systemd/mnt-media.mount is the overlay view the two
+            # dankserver/host/systemd/media-meta-view.mount is the overlay view the
             # media servers bind (scripts/media-view.sh installs it on the host),
             # so editing it restarts jellyfin and plex and nothing else.
             _add(services, "jellyfin", "plex")

scripts/deploy-remote.sh

@@ -1204,9 +1204,10 @@ deploy_romm_stack() {
 
 ensure_media_view() {
     # Both media servers read their library through the SSD-backed overlay view
-    # (scripts/media-view.sh, dankserver/host/systemd/mnt-media.mount): the array
-    # below stays read-only and every sidecar Jellyfin writes lands on the NVMe.
-    # Raise it BEFORE either container starts — a start against a bare /mnt/media
+    # (scripts/media-view.sh, dankserver/host/systemd/media-meta-view.mount): the
+    # array below stays read-only and every sidecar Jellyfin writes lands on the
+    # NVMe.
+    # Raise it BEFORE either container starts — a start against a bare view
     # directory would let a scan clear the library database. The units also carry
     # ConditionPathIsMountPoint, so a missing view skips the start rather than
     # damaging anything. A relayout must be followed by `media-view.sh reap`

scripts/media-view.sh

@@ -11,7 +11,10 @@
 #   lowerdir  /mnt/entropy                RAID6 (ROTA=1) — source of truth, never written
 #   upperdir  /var/lib/media-meta/upper   NVMe — every sidecar and image byte
 #   workdir   /var/lib/media-meta/work    NVMe — kernel bookkeeping
-#   Where     /mnt/media                  what jellyfin and plex bind
+#   Where     /var/lib/media-meta/view    the merged tree jellyfin and plex bind
+#
+# Everything the view needs — layers, bookkeeping, trash, the merged door — lives
+# under the one directory /var/lib/media-meta, so nothing new appears under /mnt.
 #
 # Consequences worth knowing:
 #   * A sidecar write is a few KB onto the SSD; the media bytes never move and the
@@ -37,8 +40,11 @@ set -euo pipefail
 
 LOWER=/mnt/entropy
 UPPER_BASE=/var/lib/media-meta
-VIEW=/mnt/media
-UNIT=mnt-media.mount
+VIEW=$UPPER_BASE/view
+# systemd names a mount unit after its ESCAPED path ('/' -> '-', a literal '-'
+# -> '\x2d'), so the unit on the host is var-lib-media\x2dmeta-view.mount. The
+# repo copy keeps a readable name; install writes it under the escaped one.
+UNIT='var-lib-media\x2dmeta-view.mount'
 UNIT_DIR=/etc/systemd/system
 # The rootless containers write as this host uid (the deploy user). The upper
 # layer has to accept those writes, so it is owned by them.
@@ -46,7 +52,7 @@ MEDIA_UID="${MEDIA_VIEW_UID:-1000}"
 MEDIA_GID="${MEDIA_VIEW_GID:-1000}"
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-UNIT_SRC="$REPO_ROOT/dankserver/host/systemd/$UNIT"
+UNIT_SRC="$REPO_ROOT/dankserver/host/systemd/media-meta-view.mount"
 
 die() {
     printf 'media-view: %s\n' "$*" >&2
@@ -141,7 +147,8 @@ do_install() {
     read -r src rota <<<"$(rotational_of "$upper_base")"
     [ "$rota" = 0 ] || die "refused: $upper_base is on $src, a rotational device — the metadata layer must be on the SSD"
     [ -f "$UNIT_SRC" ] || die "refused: $UNIT_SRC is missing from $REPO_ROOT"
-    install -d -m 0755 -o "$MEDIA_UID" -g "$MEDIA_GID" "$upper" "$work"
+    # systemd will not create a mount point; a missing directory fails the start.
+    install -d -m 0755 -o "$MEDIA_UID" -g "$MEDIA_GID" "$upper" "$work" "$VIEW"
     install -d -m 0700 "$upper_base/.AGENTTRASH"
     install -m 0644 "$UNIT_SRC" "$UNIT_DIR/$UNIT"
     systemctl daemon-reload