dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty

Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).

Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
  /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
  redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
  the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
  ExecStart, gitea precedent). copyparty passes its admin account via
  Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
  generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
  Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
  0.6.27-ls397), pasta network preserved.

Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).

dankserver/calibre-web/quadlet/calibre-web.container

@@ -0,0 +1,43 @@
+# Quadlet unit: Calibre-Web library server (rootless, boot-persistent).
+#
+# Install path on dankserver:
+# ~/.config/containers/systemd/calibre-web.container
+# Unit name: calibre-web.service (podman 5.x drops the container- prefix)
+#
+# The data roots already lived under /home/dank/Containers/calibre-web in the
+# compose era; this unit keeps those exact paths. The image pin is the exact
+# tag of the image the live container runs (image id 986277563e76), so the
+# cutover recreation changes zero bits of application code. No secrets: this
+# unit takes no EnvironmentFile.
+
+[Unit]
+Description=Calibre-Web library server container
+After=network.target
+
+[Container]
+ContainerName=calibre-web
+Image=lscr.io/linuxserver/calibre-web:0.6.27-ls397
+Network=pasta
+Environment=DOCKER_MODS=linuxserver/mods:universal-calibre
+Environment=LANG=en_US.UTF-8
+Environment=LANGUAGE=en_US.UTF-8
+Environment=LSIO_FIRST_PARTY=true
+Environment=OAUTHLIB_RELAX_TOKEN_SCOPE=1
+Environment=PGID=1000
+Environment=PUID=1000
+Environment=QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox
+Environment=S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
+Environment=S6_STAGE2_HOOK=/docker-mods
+Environment=TERM=xterm
+Environment=TZ=America/Vancouver
+Environment=VIRTUAL_ENV=/lsiopy
+PublishPort=8083:8083
+Volume=/home/dank/Containers/calibre-web/config:/config
+Volume=/home/dank/Containers/calibre-web/books:/books
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

dankserver/copyparty/quadlet/copyparty.container

@@ -0,0 +1,37 @@
+# Quadlet unit: Copyparty file server (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/copyparty.container
+# Unit name: copyparty.service (podman 5.x drops the container- prefix)
+#
+# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the
+# Command= line below reproduces the compose-era argv exactly: the admin
+# account is passed as -a <user>:<password>. ${COPAY_ACCOUNT} and
+# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the
+# host-local env file /home/dank/Containers/copyparty/env (mode 0600).
+# This file holds no secrets. The deployer refuses to start this unit before
+# that env file exists, so a missing env file fails the unit instead of
+# creating an admin account with a garbage password.
+#
+# /w is the entropy volume: copyparty's dank admin account is the only write
+# path into it; every other service mounts the share read-only or not at all.
+
+[Unit]
+Description=Copyparty file server container
+After=network.target
+
+[Container]
+ContainerName=copyparty
+Image=ghcr.io/9001/copyparty-ac:latest
+Network=dankserver_appnet
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
+Volume=/mnt/entropy:/w
+Volume=/home/dank/Containers/copyparty/cfg:/cfg
+
+[Service]
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

dankserver/jellyfin/quadlet/jellyfin.container

@@ -0,0 +1,58 @@
+# Quadlet unit: Jellyfin media server (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/jellyfin.container
+# Unit name: jellyfin.service (podman 5.x drops the container- prefix)
+#
+# Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at
+# cutover. The entropy volume is mounted read-only: nothing automated ever
+# writes there; copyparty is the only write path for /mnt/entropy. Every
+# creation-time environment variable of the compose-era container is kept as
+# an Environment= line (zero drift); none of them are secrets, so this unit
+# needs no EnvironmentFile.
+
+[Unit]
+Description=Jellyfin media server container
+After=network.target
+
+[Container]
+ContainerName=jellyfin
+Image=ghcr.io/jellyfin/jellyfin:latest
+Network=dankserver_appnet
+Environment=DEBIAN_FRONTEND=noninteractive
+Environment=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true
+Environment=JELLYFIN_CACHE_DIR=/cache
+Environment=JELLYFIN_CONFIG_DIR=/config/config
+Environment=JELLYFIN_DATA_DIR=/config
+Environment=JELLYFIN_FFMPEG=/usr/lib/jellyfin-ffmpeg/ffmpeg
+Environment=JELLYFIN_LOG_DIR=/config/log
+Environment=JELLYFIN_PublishedServerUrl=http://192.168.0.235:8096
+Environment=JELLYFIN_WEB_DIR=/jellyfin/jellyfin-web
+Environment=LANG=en_US.UTF-8
+Environment=LANGUAGE=en_US:en
+Environment=LC_ALL=en_US.UTF-8
+Environment=LD_PRELOAD=/usr/lib/jellyfin/libjemalloc.so.2
+Environment=MALLOC_TRIM_THRESHOLD_=131072
+Environment=NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
+Environment=NVIDIA_VISIBLE_DEVICES=all
+Environment=XDG_CACHE_HOME=/cache
+PublishPort=8096:8096
+PublishPort=8920:8920
+PublishPort=7359:7359/udp
+PublishPort=1900:1900/udp
+Volume=/home/dank/Containers/jellyfin/config:/config
+Volume=/home/dank/Containers/jellyfin/cache:/cache
+Volume=/mnt/entropy/Movies:/data/movies:ro
+Volume=/mnt/entropy/TVShows:/data/shows:ro
+Device=/dev/dri
+GroupAdd=keep-groups
+HealthCmd=curl -f http://localhost:8096/health
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

dankserver/romm/quadlet/romm-mariadb.container

@@ -0,0 +1,34 @@
+# Quadlet unit: MariaDB backing store for RomM (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm-mariadb.container
+# Unit name: romm-mariadb.service (podman 5.x drops the container- prefix)
+#
+# The alias `mariadb` on dankserver_appnet is what makes DB_HOST=mariadb in
+# the RomM unit resolve. Secrets (MARIADB_ROOT_PASSWORD, MARIADB_PASSWORD)
+# live in the shared host-local env file /home/dank/Containers/romm/env
+# (mode 0600); this file holds no secrets.
+
+[Unit]
+Description=RomM MariaDB database container
+After=network.target
+
+[Container]
+ContainerName=romm-mariadb
+Image=docker.io/library/mariadb:11
+Network=dankserver_appnet:alias=mariadb
+EnvironmentFile=/home/dank/Containers/romm/env
+Environment=MARIADB_DATABASE=romm
+Environment=MARIADB_USER=romm
+Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql
+HealthCmd=mariadb-admin ping -h localhost
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=3
+
+[Service]
+EnvironmentFile=/home/dank/Containers/romm/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

dankserver/romm/quadlet/romm-redis.container

@@ -0,0 +1,28 @@
+# Quadlet unit: Redis cache for RomM (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm-redis.container
+# Unit name: romm-redis.service (podman 5.x drops the container- prefix)
+#
+# The alias `redis` on dankserver_appnet is what makes REDIS_HOST=redis in
+# the RomM unit resolve. No secrets: this unit takes no EnvironmentFile.
+
+[Unit]
+Description=RomM Redis cache container
+After=network.target
+
+[Container]
+ContainerName=romm-redis
+Image=docker.io/library/redis:7-alpine
+Network=dankserver_appnet:alias=redis
+Volume=/home/dank/Containers/romm/redis:/data
+HealthCmd=redis-cli ping
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=3
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

dankserver/romm/quadlet/romm.container

@@ -0,0 +1,42 @@
+# Quadlet unit: RomM library manager (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm.container
+# Unit name: romm.service (podman 5.x drops the container- prefix)
+#
+# The whole data root lives at /home/dank/Containers/romm and is mounted at
+# /romm, so config/, library/, resources/ and assets/ sit inside it exactly as
+# the compose-era bind mounts + anonymous volume did. Secrets (DB_PASSWD,
+# ROMM_AUTH_SECRET_KEY, ROMM_PASSWORD, SCREENSCRAPER_DEV_*) live in the
+# host-local env file /home/dank/Containers/romm/env (mode 0600); this file
+# holds no secrets. The network dankserver_appnet must exist before first
+# start (it is the compose-era network; on a fresh host create it first).
+
+[Unit]
+Description=RomM library manager container
+Wants=romm-mariadb.service
+After=romm-mariadb.service romm-redis.service network.target
+
+[Container]
+ContainerName=romm
+Image=ghcr.io/rommapp/romm:latest
+Network=dankserver_appnet
+EnvironmentFile=/home/dank/Containers/romm/env
+Environment=DB_HOST=mariadb
+Environment=DB_NAME=romm
+Environment=DB_USER=romm
+Environment=REDIS_HOST=redis
+Environment=HASHEOUS_API_ENABLED=true
+PublishPort=8085:8080
+Volume=/home/dank/Containers/romm:/romm
+HealthCmd=curl -f http://localhost:8080/health
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+EnvironmentFile=/home/dank/Containers/romm/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target