docs: Jellyfin LDAP 401 resolved — legacy /Users/Auth/Password route removed in 12.1

The auth works via the modern /Users/AuthenticateByName endpoint (what the
web UI uses). The 401 was a test artifact from probing the dead legacy route.
No config change needed; LDAP-Auth plugin + authentik 2026.8.3 outpost healthy.

serverAppConfigs-docs/Dankserver/Jellyfin.md

@@ -95,6 +95,15 @@ service-account password is stored only in the Jellyfin plugin config (the
 search both succeed from Dankclaw; a real user (`alex`, in `jellyfin_users`)
 logged into the web UI with their authentik password and the plugin created
 the matching Jellyfin user.
+**Gotcha — the login endpoint changed in Jellyfin 12.1.** The legacy
+`POST /Users/Auth/Password` route (and its `LegacyEmbyRouteRewriteMiddleware`)
+was removed; probing it now returns a silent 401 with no plugin log, which
+reads like an auth failure but is just a dead route. The web UI and modern
+clients use `POST /Users/AuthenticateByName` (with the `Authorization:
+MediaBrowser Client=…, DeviceId=…, Device=…, Version=…` header), which is
+where the LDAP plugin runs. Verified 2026-09-25: `alex` authenticates over
+`AuthenticateByName` (HTTP 200; full plugin flow logged — service bind,
+search, `ldapUid`, user bind, token).
 
 ## Configuration workflow
 

serverAppConfigs-docs/log.md

@@ -1,6 +1,7 @@
 # Bundle Change Log
 
 ## 2026-09-25
+- `/serverAppConfigs-docs/Dankserver/Jellyfin.md` — Jellyfin LDAP 401 resolved: the auth works via the modern `/Users/AuthenticateByName` endpoint (HTTP 200, alex authenticated, full plugin flow logged: service bind → search → ldapUid → user bind → token). The 401 was a test artifact — I had been probing the legacy `/Users/Auth/Password` route, which Jellyfin 12.1 removed (the `LegacyEmbyRouteRewriteMiddleware` is gone). The web UI uses the modern endpoint, so user logins are fine. No config change needed; the LDAP-Auth 23.0.0.0 plugin + authentik 2026.8.3 outpost are healthy.
 - Fleet-wide container update (dankclaw + dankserver) — every pullable image brought current. Pinned bumps: authentik `2026.8.0`→`2026.8.3` (server/worker/outpost), tautulli `v2.18.1-ls242`→`ls245`, calibre-web `0.6.27-ls397`→`ls402`, plex `1.43.3.10896`→`1.43.4.10903`; seerr already at `v3.4.1`. Local-build rebuilds (forced `--no-cache`, the base images had moved): caddy (xcaddy porkbun), alloy, loki, comfyui-rocm (ComfyUI re-cloned), hermes ×3 (fresh `:latest`, `23986f31`→`e1e87aec`). anubis already at latest stable `v1.27.0` (only pre-releases exist beyond). Verified: all 16 floating-tag services CURRENT (zero stale), every real container active, caddy edge serving (auth 302 / ai 200), 340 bats green. Excluded: frank-medium/radiance-vllm (custom LLM build).
 - `/dankserver/{tautulli,calibre-web,plex}/quadlet/*.container`, `/dankclaw/authentik/quadlet/*.container` — version pins bumped; docs (Tautulli.md, Calibre-Web.md, Plex.md, Authentik.md + server/worker, index.md) and the dead `dankserver/compose.yaml` plex entry synced (0b1ea2e).