dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty

Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).

Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
  /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
  redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
  the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
  ExecStart, gitea precedent). copyparty passes its admin account via
  Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
  generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
  Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
  0.6.27-ls397), pasta network preserved.

Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).

scripts/deploy-plan.py

@@ -42,8 +42,8 @@ SERVICE_ORDER = (
     "authentik-outpost",
     "caddy",
     "homepage",
-    "mariadb",
-    "redis",
+    "romm-mariadb",
+    "romm-redis",
     "romm",
     "copyparty",
     "jellyfin",
@@ -89,8 +89,8 @@ DANKCLAW_SERVICES = {
 }
 
 DANKSERVER_SERVICES = {
-    "mariadb",
-    "redis",
+    "romm-mariadb",
+    "romm-redis",
     "romm",
     "copyparty",
     "jellyfin",
@@ -134,6 +134,8 @@ DANKSERVER_COMPOSE_SERVICES = {
     "lidarr",
     "readarr",
 }
+COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
+
 
 
 def _add(services: set[str], *names: str) -> None:
@@ -191,7 +193,7 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
     # An unavailable or malformed revision is safer as a broad compose plan
     # than as a silent no-op. It still cannot include LLM units.
     if (old_doc and not new_doc) or (new_doc and not old_doc and names):
-        return allowed
+        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
 
     # Top-level networks/configuration can affect every compose service even
     # when no individual service mapping changed. Ignore the services key while
@@ -199,9 +201,10 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
     old_globals = {key: value for key, value in old_doc.items() if key != "services"}
     new_globals = {key: value for key, value in new_doc.items() if key != "services"}
     if old_globals != new_globals:
-        return allowed
+        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
 
-    return {name for name in names if name in allowed and old.get(name) != new.get(name)}
+    changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
+    return {COMPOSE_NAME_MAP.get(n, n) for n in changed}
 
 
 def services_for_path(path: str, target: str) -> set[str]:
@@ -297,7 +300,17 @@ def services_for_path(path: str, target: str) -> set[str]:
 
     if parts[0] == "dankserver":
         if len(parts) >= 2 and parts[1] == "compose.yaml":
-            _add(services, *DANKSERVER_COMPOSE_SERVICES)
+            # Compose service keys map onto the deployed unit names.
+            _add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
+            return services
+        if len(parts) >= 3 and parts[2] == "quadlet":
+            quadlet_services = {
+                "romm": {"romm", "romm-mariadb", "romm-redis"},
+                "jellyfin": {"jellyfin"},
+                "calibre-web": {"calibre-web"},
+                "copyparty": {"copyparty"},
+            }
+            _add(services, *quadlet_services.get(parts[1], set()))
         return services
 
     if parts[0] == "scripts":