dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty

Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).

Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
  /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
  redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
  the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
  ExecStart, gitea precedent). copyparty passes its admin account via
  Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
  generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
  Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
  0.6.27-ls397), pasta network preserved.

Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).

tests/dankserver_quadlet.bats

@@ -0,0 +1,45 @@
+#!/usr/bin/env bats
+# Seam: the six cutover-era dankserver quadlet units (romm trio, jellyfin,
+# calibre-web, copyparty) must keep their boot-persistence and v1-generator
+# contracts. The podman 5.x v1 Quadlet generator silently drops or hard-fails
+# on several keys; these tests pin the contract that keeps the units loadable
+# and secret-free in the repo.
+
+load helpers
+
+@test "all six cutover units exist under dankserver/<svc>/quadlet/" {
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
+        [ -f "$REPO_ROOT/dankserver/$unit.container" ] || return 1
+    done
+}
+
+@test "every cutover unit is boot-persistent (WantedBy=default.target)" {
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
+        grep -q '^WantedBy=default.target$' "$REPO_ROOT/dankserver/$unit.container" || return 1
+    done
+}
+
+@test "copyparty uses Exec= not Command= (v1 generator hard-fails on Command=)" {
+    unit="$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container"
+    grep -q '^Command=' "$unit" && return 1
+    grep -q '^Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}' "$unit" || return 1
+}
+
+@test "copyparty and romm consume host-local env files, never in-repo secrets" {
+    grep -q '^EnvironmentFile=/home/dank/Containers/copyparty/env$' \
+        "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb; do
+        grep -q '^EnvironmentFile=/home/dank/Containers/romm/env$' \
+            "$REPO_ROOT/dankserver/$unit.container" || return 1
+    done
+    # No literal credential may ever appear in a tracked unit file: the only
+    # Exec= arguments must be variable expansions, never a literal account:secret.
+    ! grep -qE '\-a [A-Za-z0-9]+:[A-Za-z0-9]' "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
+}
+
+@test "romm db services keep their service-discovery aliases on the appnet" {
+    grep -q '^Network=dankserver_appnet:alias=mariadb$' \
+        "$REPO_ROOT/dankserver/romm/quadlet/romm-mariadb.container" || return 1
+    grep -q '^Network=dankserver_appnet:alias=redis$' \
+        "$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1
+}