fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy

Jellyfin 10.11 writes metadata to /config/data/metadata, not
/config/metadata — the old bind left bulk artwork on the root disk.
Moved existing metadata to /storage1 and corrected the compose mount.
Also sets TranscodingTempPath=/transcode.

Caddy deploy: job containers never saw /config/caddy; write via a
host-bind docker run instead. apply-compose.ps1 -Caddy stages through
/tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.

.env

@@ -111,7 +111,8 @@ GITHUB_RUNNER_ACCESS_TOKEN=github_pat_11ACRHQAI0q3n1svrl9jmT_ai2bQlXWSxY8HJjEI6q
 # Used by StackCreateDockerStandaloneRepository and StackGitRedeploy.
 # Pass as RepositoryAuthorizationType:0 (Basic), RepositoryUsername=ginnoir.
 # Runner PAT above does NOT work for this — different scopes.
-GITHUB_STACKS_PAT=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
+# Gitea PAT for Portainer git stacks (env var name kept from GitHub era)
+GITHUB_STACKS_PAT=54ea93904439c2919f1d8dab1ba545e54a2a3e86
 
 # =============================================================
 # DEV STACK

.gitea/workflows/deploy-caddy.yml

@@ -17,6 +17,15 @@ jobs:
 
       - name: Push Caddyfile and reload Caddy
         run: |
+          # Job containers do NOT inherit the runner's /config/caddy bind.
+          # Docker-from-Docker with a host bind is the reliable path: the
+          # volume source is resolved on valhalla, not inside the job container.
+          # (Direct `cp /config/caddy/...` only works on the runner container
+          # itself, which is not where this step runs.)
           apt-get update -qq && apt-get install -y -qq docker.io
-          cp Caddyfile /config/caddy/Caddyfile
+          docker run --rm \
+            -v /config/caddy:/dest \
+            -v "$PWD/Caddyfile:/src/Caddyfile:ro" \
+            alpine:3.20 \
+            cp /src/Caddyfile /dest/Caddyfile
           docker exec caddy caddy reload --config /etc/caddy/Caddyfile

apply-compose.ps1

@@ -41,8 +41,11 @@ if ($EnvFile) {
 }
 
 if ($Caddy) {
+    # /config/caddy is root-owned on valhalla — scp directly fails with
+    # "Permission denied". Stage via /tmp and sudo-install.
     Write-Host "Pushing Caddyfile ..."
-    scp $caddyLocal "${server}:/config/caddy/Caddyfile"
+    scp $caddyLocal "${server}:/tmp/Caddyfile.new"
+    ssh $server "sudo cp /tmp/Caddyfile.new /config/caddy/Caddyfile && sudo chown root:root /config/caddy/Caddyfile && rm -f /tmp/Caddyfile.new"
     Write-Host "Reloading Caddy ..."
     ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }

stacks/streaming/docker-compose.yml

@@ -4,8 +4,9 @@
 # (metadata, trickplay, cache, transcodes) on /storage1. The root disk is only
 # 194G and has filled twice; nothing here may grow unbounded on it.
 #
-# Trickplay gets an explicit sub-bind because Jellyfin 10.11 moved it to
-# /config/data/trickplay and it is NOT relocatable from the UI.
+# Jellyfin 10.11 (linuxserver) keeps metadata at /config/data/metadata — NOT
+# /config/metadata. Trickplay is at /config/data/trickplay and is not
+# relocatable from the UI. Transcodes are configured to /transcode.
 #
 # Transcodes are disk-backed, not tmpfs: jellyfin#16608 means Remux and
 # DirectStream jobs finish before the segment cleaner's first check, orphaning
@@ -30,7 +31,7 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /config/jellyfin:/config
-      - /storage1/labdata/jellyfin/metadata:/config/metadata
+      - /storage1/labdata/jellyfin/metadata:/config/data/metadata
       - /storage1/labdata/jellyfin/cache:/config/cache
       - /storage1/labdata/jellyfin/trickplay:/config/data/trickplay
       - /storage1/labdata/jellyfin/transcodes:/transcode