feat(k8s/jellyfin): add Jellyfin stack (deployment scaled to 0 for data migration)

Jellyfin media server with Intel GPU hardware transcoding, NFS media
volume, and UDP discovery/DLNA ports. OIDC auth handled internally
by Jellyfin (no Authelia middleware on ingress).

kubernetes/app/jellyfin/pvc.yaml

@@ -0,0 +1,43 @@
+---
+# Jellyfin config (includes metadata)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 30Gi
+---
+# Jellyfin cache (transcoding temp files etc.)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-cache
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 20Gi
+---
+# Shared media library (NFS)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: jellyfin-media-nfs
+  resources:
+    requests:
+      storage: 1Ti