fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy

Jellyfin 10.11 writes metadata to /config/data/metadata, not
/config/metadata — the old bind left bulk artwork on the root disk.
Moved existing metadata to /storage1 and corrected the compose mount.
Also sets TranscodingTempPath=/transcode.

Caddy deploy: job containers never saw /config/caddy; write via a
host-bind docker run instead. apply-compose.ps1 -Caddy stages through
/tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.

apply-compose.ps1

@@ -41,8 +41,11 @@ if ($EnvFile) {
 }
 
 if ($Caddy) {
+    # /config/caddy is root-owned on valhalla — scp directly fails with
+    # "Permission denied". Stage via /tmp and sudo-install.
     Write-Host "Pushing Caddyfile ..."
-    scp $caddyLocal "${server}:/config/caddy/Caddyfile"
+    scp $caddyLocal "${server}:/tmp/Caddyfile.new"
+    ssh $server "sudo cp /tmp/Caddyfile.new /config/caddy/Caddyfile && sudo chown root:root /config/caddy/Caddyfile && rm -f /tmp/Caddyfile.new"
     Write-Host "Reloading Caddy ..."
     ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }