feat(streaming): add jellyfin stack

New Portainer stack: jellyfin, jellystat + postgres, wizarr and
jellyplex-watched. Bulk data (metadata, trickplay, cache, transcodes)
binds to /storage1; only SQLite config lands on the root disk.

Trickplay gets an explicit sub-bind because 10.11 moved it to
/config/data/trickplay, which is not relocatable from the UI. Transcodes
are disk-backed rather than tmpfs because jellyfin#16608 orphans segments
on the Remux/DirectStream jobs that are routine on this server.

stacks/streaming/stack.env

@@ -0,0 +1,31 @@
+# streaming stack config — injected into every service via env_file.
+# Var names are exactly what the containers read; no ${VAR} interpolation,
+# no Portainer UI env vars needed.
+
+# --- shared ---
+TZ=America/Chicago
+PUID=1000
+PGID=1000
+
+# --- jellystat-db (postgres:16-alpine) ---
+POSTGRES_DB=jfstat
+POSTGRES_USER=jellystat
+POSTGRES_PASSWORD=bf2d47d8e1a87baf2b4942704a5acfaf5c2aad336fdd480e
+
+# --- jellystat ---
+POSTGRES_IP=jellystat-db
+POSTGRES_PORT=5432
+JWT_SECRET=0dd9fcdb632277b76977dbada8226e547cc773e1deafc8d778d4038f8d59393b
+
+# --- jellyplex-watched ---
+# Plex is host-native, not containerised, so it is reached on the LAN IP.
+PLEX_URL=http://192.168.1.69:32400
+PLEX_TOKEN=hM9aycswHKSsUrxiHqwq
+JELLYFIN_BASEURL=http://jellyfin:8096
+JELLYFIN_TOKEN=
+SYNC_FROM_PLEX_TO_JELLYFIN=True
+SYNC_FROM_JELLYFIN_TO_PLEX=True
+# Start in dry-run. Task 16 flips this to False after the mapping is verified.
+DRYRUN=True
+SLEEP_DURATION=21600
+LOG_LEVEL=INFO