dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty

Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).

Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
  /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
  redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
  the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
  ExecStart, gitea precedent). copyparty passes its admin account via
  Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
  generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
  Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
  0.6.27-ls397), pasta network preserved.

Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).

dankserver/copyparty/quadlet/copyparty.container

@@ -0,0 +1,37 @@
+# Quadlet unit: Copyparty file server (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/copyparty.container
+# Unit name: copyparty.service (podman 5.x drops the container- prefix)
+#
+# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the
+# Command= line below reproduces the compose-era argv exactly: the admin
+# account is passed as -a <user>:<password>. ${COPAY_ACCOUNT} and
+# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the
+# host-local env file /home/dank/Containers/copyparty/env (mode 0600).
+# This file holds no secrets. The deployer refuses to start this unit before
+# that env file exists, so a missing env file fails the unit instead of
+# creating an admin account with a garbage password.
+#
+# /w is the entropy volume: copyparty's dank admin account is the only write
+# path into it; every other service mounts the share read-only or not at all.
+
+[Unit]
+Description=Copyparty file server container
+After=network.target
+
+[Container]
+ContainerName=copyparty
+Image=ghcr.io/9001/copyparty-ac:latest
+Network=dankserver_appnet
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
+Volume=/mnt/entropy:/w
+Volume=/home/dank/Containers/copyparty/cfg:/cfg
+
+[Service]
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target