feat(calibre-server): Calibre Content Server as a boot-persistent Quadlet

lscr.io/linuxserver/calibre:9.15.0 (desktop build) running calibre-server
as the s6 main service on internal 8090 -> host 8084, auth-gated with a
plaintext userdb (mode 600) bootstrapped once by the deploy handler.
The desktop GUI is kept on 8080/8182, basic-authed with the same
credential pair via the machine-local env file.

dankserver/calibre-server/quadlet/calibre-server.container

@@ -0,0 +1,59 @@
+# Quadlet unit: Calibre Content Server (rootless, boot-persistent).
+#
+# Install path on dankserver:
+# ~/.config/containers/systemd/calibre-server.container
+# Unit name: calibre-server.service (podman 5.x drops the container- prefix)
+#
+# The image is the CURRENT linuxserver/calibre (9.15.0), which is a desktop
+# image (Selkies web-streamed GUI on 8080/8181) with the headless
+# calibre-server available inside. The compose-era snippet in
+# serverAppConfigs-docs/Dankserver/Calibre.md predates the desktop revamp;
+# the dedicated headless images (ta264/docker-calibre, agentgreen) are
+# dormant (calibre 6.10 / 2017), so this unit runs calibre-server as the
+# image's s6-overlay main service via Exec= and keeps the desktop as a
+# bonus (browser GUI on 8080, basic-authed via the env file).
+#
+# Port map (Network=pasta, so container ports bind on the host directly):
+#   8090 -> host 8084  calibre-server (the content server; 8080 is taken by
+#                      the image's own nginx, 8083 by calibre-web)
+#   8080 -> host 8080  desktop GUI (nginx; CUSTOM_HTTPS_PORT moved to 8182
+#                      because Tautulli holds host 8181)
+#
+# Auth: calibre-server 9.x keeps its users in a SQLite userdb (the pw column
+# is PLAINTEXT, so the file is mode 600). The single admin account is
+# bootstrapped once by the deploy handler (deploy_calibre_server) via
+# `calibre-server --manage-users -- add`, password piped on stdin with
+# printf (a trailing newline from echo lands in the stored password and
+# breaks every login). The desktop's basic auth (CUSTOM_USER/CUSTOM_PASSWORD)
+# reuses the same credential pair. Both live in the machine-local env file;
+# this unit holds no secrets.
+#
+# --auth-mode=basic is required: on a non-SSL port the server defaults to
+# Digest auth, which rejects plain Basic clients with 400 "Unsupported
+# authentication method".
+
+[Unit]
+Description=Calibre content server container
+After=network.target
+
+[Container]
+ContainerName=calibre-server
+Image=lscr.io/linuxserver/calibre:9.15.0
+Network=pasta
+EnvironmentFile=/home/dank/Containers/calibre-server/env
+Environment=PUID=1000
+Environment=PGID=1000
+Environment=TZ=America/Vancouver
+Environment=CUSTOM_HTTPS_PORT=8182
+Volume=/home/dank/Containers/calibre-web/books:/books
+Volume=/home/dank/Containers/calibre-server/userdb.sqlite:/userdb.sqlite
+Exec=calibre-server --port 8090 --enable-auth --auth-mode=basic --userdb /userdb.sqlite /books
+PublishPort=8084:8090
+
+[Service]
+TimeoutStartSec=300
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target