fix(dankserver): jellyfin user-mapping and readarr image tag

Jellyfin ran as user 1000:1000 inside a rootless user namespace, where host
uid 1000 maps to container uid 0 — the pinned uid is unmapped, so /config/log
creation EACCES'd and the service SIGSEGV'd on boot. Container root (= host
dank) is correct under rootless podman; group_add 992 (render) still maps via
the userns group map, so GPU access is preserved.

Readarr: lscr.io/linuxserver/readarr:latest does not exist — LSIO ships only
arch-prefixed nightly/version tags for readarr (verified against the ghcr tag
API). Pin amd64-1.0.980, the newest stable tag.

dankserver/compose.yaml

@@ -97,7 +97,6 @@ services:
     image: jellyfin/jellyfin:latest
     container_name: jellyfin
     restart: unless-stopped
-    user: "1000:1000"
     ports:
       - "8096:8096/tcp"
       - "8920:8920/tcp"
@@ -233,7 +232,7 @@ services:
     networks: [appnet]
 
   readarr:
-    image: lscr.io/linuxserver/readarr:latest
+    image: lscr.io/linuxserver/readarr:amd64-1.0.980
     container_name: readarr
     restart: unless-stopped
     environment: