fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy

Jellyfin 10.11 writes metadata to /config/data/metadata, not
/config/metadata — the old bind left bulk artwork on the root disk.
Moved existing metadata to /storage1 and corrected the compose mount.
Also sets TranscodingTempPath=/transcode.

Caddy deploy: job containers never saw /config/caddy; write via a
host-bind docker run instead. apply-compose.ps1 -Caddy stages through
/tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.

stacks/streaming/docker-compose.yml

@@ -4,8 +4,9 @@
 # (metadata, trickplay, cache, transcodes) on /storage1. The root disk is only
 # 194G and has filled twice; nothing here may grow unbounded on it.
 #
-# Trickplay gets an explicit sub-bind because Jellyfin 10.11 moved it to
-# /config/data/trickplay and it is NOT relocatable from the UI.
+# Jellyfin 10.11 (linuxserver) keeps metadata at /config/data/metadata — NOT
+# /config/metadata. Trickplay is at /config/data/trickplay and is not
+# relocatable from the UI. Transcodes are configured to /transcode.
 #
 # Transcodes are disk-backed, not tmpfs: jellyfin#16608 means Remux and
 # DirectStream jobs finish before the segment cleaner's first check, orphaning
@@ -30,7 +31,7 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /config/jellyfin:/config
-      - /storage1/labdata/jellyfin/metadata:/config/metadata
+      - /storage1/labdata/jellyfin/metadata:/config/data/metadata
       - /storage1/labdata/jellyfin/cache:/config/cache
       - /storage1/labdata/jellyfin/trickplay:/config/data/trickplay
       - /storage1/labdata/jellyfin/transcodes:/transcode