docs: fact-check sweep, Jellyfin, *arr stack, and ROM scraping guides

Fact-check results:
- RomM 5.2.0: MariaDB+Redis now required (was SQLite), auth var renamed, 11 metadata providers
- Copyparty v1.20.19: 3 CVEs fixed, WOPI integration, docker editions documented
- Calibre-Web 0.6.27-ls397: version pinning, kepubify auto-config, CVE fixes
- Calibre 9.9.0: content server security fix noted

New documentation:
- docs/Dankserver/Jellyfin.md — full media server guide (compose, Caddy, GPU, metadata, clients)
- docs/Dankserver/ARR-Stack.md — automated download stack overview
- docs/Dankserver/RomM-Scraping.md — metadata providers, naming, cover art, emulator integration
- docs/Dankserver/sonarr.md, radarr.md, lidarr.md, readarr.md, prowlarr.md, qbittorrent.md
- docs/Dankserver/mariadb.md, redis.md — supporting services for RomM

Infrastructure updates:
- dankserver/compose.yaml: added mariadb, redis, jellyfin, *arr services
- dankserver/Caddyfile: added hostnames for all new services
- dankserver/.env.example: added all new environment variables
- docs/index.md: linked all new documentation pages

Tested: 52/52 tests pass.

docs/Dankserver/Calibre-Web.md

@@ -1,44 +1,93 @@
 # Calibre-Web
 
-Calibre-Web is a web app that browses, reads, and downloads eBooks from an existing Calibre library database. It is the web frontend for the Calibre e-book manager.
+Calibre-Web is a web application that browses, reads, and downloads eBooks from an existing Calibre library database. It serves as the web frontend for the Calibre e-book manager.
 
 **Host:** Dankserver — **Hostname:** `books.dankserver.local` — **Docs:** https://github.com/linuxserver/docker-calibre-web
 
-## Facts (from research, primary source)
+## Facts
 
 | Item | Value |
 |------|-------|
-| Image | `lscr.io/linuxserver/calibre-web:latest` (already running on Dankserver) |
+| Latest version | 0.6.27-ls397 |
+| Image | `lscr.io/linuxserver/calibre-web:0.6.27-ls397` |
+| Base OS | Ubuntu Noble (24.04 LTS, since 2024-12-05) |
 | Port | 8083 (host) → 8083 (container) |
-| Env | `PUID=1000`, `PGID=1000`, `TZ=Etc/UTC` |
-| Optional | `DOCKER_MODS=linuxserver/mods:universal-calibre` (ebook conversion, x86-64 only) |
-| Volumes | `/config` (internal db + config), `/books` (existing Calibre library) |
-| Extra tools | `unrar` (path `/usr/bin/unrar`), `kepubify` (path `/usr/bin/kepubify`) |
+| Default login | `admin` / `admin123` |
+| Docker mod | `linuxserver/mods:universal-calibre` (ebook conversion, x86-64 only) |
+| Volumes | `/config` (internal database + config), `/books` (existing Calibre library) |
+| Extra tools | `unrar` at `/usr/bin/unrar`, `kepubify` at `/usr/bin/kepubify` (pre-configured since 2025-01-07) |
+
+## CVEs Fixed in Latest Version
+
+| CVE | Issue |
+|-----|-------|
+| CVE-2025-7404 | External binary names (e.g. `unrar`) restricted to prevent RCE |
+| — | XSS in book comments imported via Calibre, now sanitized |
+
+Additional packages added: `libxfixes3` and `libasound2t64` to support epub-to-pdf conversion. The `--no-sandbox` flag is applied to qtwebengine to prevent crashes in Docker.
 
 ## Configuration
 
-- Set the library path in the Calibre-Web admin page: Basic Configuration → Calibre Database → Location of Calibre database = `/books`.
-- Set the external binary paths in Basic Configuration → External Binaries after first login.
-- The default login is `admin` / `admin123` on first boot; change it immediately.
+### Environment Variables
+
+| Variable | Value | Description |
+|----------|-------|-------------|
+| `PUID` | `1000` | User ID |
+| `PGID` | `1000` | Group ID |
+| `TZ` | `Etc/UTC` | Timezone |
+| `DOCKER_MODS` | `linuxserver/mods:universal-calibre` | Optional: enables ebook conversion tools |
+| `OAUTHLIB_RELAX_TOKEN_SCOPE` | `1` | Required for Google OAuth |
+
+### Setup Steps
+
+1. Point the container at the Calibre library directory (set the `/books` volume).
+2. Log in with `admin` / `admin123` and change the password immediately.
+3. In Basic Configuration → Calibre Database → set Location of Calibre database to `/books`.
+4. In Basic Configuration → External Binaries → set the directory to `/usr/bin/` for Calibre-Web >= 0.6.22.
+5. **kepubify is pre-configured** since version 0.6.27. No need to set the kepubify path manually.
+6. Set up Google OAuth if desired (requires `OAUTHLIB_RELAX_TOKEN_SCOPE=1`).
 
 ## Volumes
 
 | Container path | Host path (convention) |
 |----------------|------------------------|
 | `/config` | `/opt/calibre-web/config` |
-| `/books` | the existing Calibre library directory (user-entered later) |
+| `/books` | The existing Calibre library directory (user-entered during setup) |
 
-## Healthcheck
+## Docker Compose
 
-The web UI responds on 8083. A `wget -q --spider` check on `/` suffices.
+```yaml
+services:
+  calibre-web:
+    image: lscr.io/linuxserver/calibre-web:0.6.27-ls397
+    container_name: calibre-web
+    restart: unless-stopped
+    environment:
+      PUID: "1000"
+      PGID: "1000"
+      TZ: Etc/UTC
+      OAUTHLIB_RELAX_TOKEN_SCOPE: "1"
+    ports:
+      - "8083:8083"
+    volumes:
+      - /opt/calibre-web/config:/config
+      - /opt/calibre-web/books:/books
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8083/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+```
 
 ## Gotchas
 
-- If the DB path is wrong, login appears to succeed but the library is empty.
-- Ebook conversion needs the `universal-calibre` mod AND the external binary path set to `/usr/bin/ebook-convert` (or `/usr/bin/` on newer versions).
-- Google OAuth needs `OAUTHLIB_RELAX_TOKEN_SCOPE=1`.
+- **Wrong database path:** Login appears to succeed but the library is empty. Verify the Calibre database path in the admin page.
+- **Ebook conversion:** Requires the `universal-calibre` Docker mod AND the external binary path set to `/usr/bin/` (directory, not full path to `ebook-convert`).
+- **Google OAuth:** Set `OAUTHLIB_RELAX_TOKEN_SCOPE=1` or OAuth login fails.
+- **calibre 9.9.0 content server security fix:** A bug since v6.16.0 allows any user with server access to read non-Calibre files on the host. Upgrade to 9.9.0+ if serving content to untrusted users.
 
 ## See Also
 
 - [[Dankserver Stack]]
 - [[Calibre]] — the underlying library engine (host tool, not a container)
+- [[ARR-Stack]] — Readarr for automatic ebook downloads into the Calibre library