feat(k8s/jellyfin): add Jellyfin stack (deployment scaled to 0 for data migration)

Jellyfin media server with Intel GPU hardware transcoding, NFS media
volume, and UDP discovery/DLNA ports. OIDC auth handled internally
by Jellyfin (no Authelia middleware on ingress).

kubernetes/app/jellyfin/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin
+  labels:
+    pod-security.kubernetes.io/enforce: privileged