jellyfin: scope k8up backup to config PVC only

The jellyfin-config Schedule had no PVC selector and the k8up chart runs
skipWithoutAnnotation=false, so restic swept in every PVC in the namespace
(media, transcode scratch, redis, per-pod cache, CNPG data) — RWO volumes
also fail to mount while in use. k8up 4.10.0's Schedule CRD has no positive
PVC selector, so exclude every non-config PVC by annotation.

- Annotate media-tv, media-movies, transcode and redis-data PVCs with
  k8up.io/backup: "false".
- Annotate the per-pod cache volumeClaimTemplate the same way.
- Propagate the annotation to the CNPG data PVCs via inheritedMetadata
  (postgres has its own barmanObjectStore backup).
- Leave jellyfin-config unannotated so it remains the only backup target.

apps/base/jellyfin/cnpg_cluster.yaml

@@ -10,6 +10,13 @@ metadata:
   name: jellyfin-postgres
   namespace: jellyfin
 spec:
+  # Exclude the operator-managed data PVCs (jellyfin-postgres-N) from the
+  # jellyfin-config k8up Schedule (skipWithoutAnnotation is false cluster-wide,
+  # so unannotated PVCs are swept in). Postgres has its own barmanObjectStore
+  # backup below; restic must not touch the raw RWO data volumes.
+  inheritedMetadata:
+    annotations:
+      k8up.io/backup: "false"
   affinity:
     podAntiAffinityType: preferred
   backup:

apps/base/jellyfin/pvc-media-movies.yaml

@@ -7,6 +7,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-media-movies
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/pvc-media-tv.yaml

@@ -7,6 +7,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-media-tv
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only jellyfin-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/pvc-transcode.yaml

@@ -8,6 +8,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-transcode
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Transcode is RWX
+    # scratch — nothing to back up.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteMany

apps/base/jellyfin/redis-pvc.yaml

@@ -4,6 +4,11 @@ kind: PersistentVolumeClaim
 metadata:
   name: jellyfin-redis-data
   namespace: jellyfin
+  annotations:
+    # Exclude from the jellyfin-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Redis holds only
+    # ephemeral transcode-lease state; RWO would also fail to mount while in use.
+    k8up.io/backup: "false"
 spec:
   accessModes:
     - ReadWriteOnce

apps/base/jellyfin/statefulset.yaml

@@ -230,6 +230,11 @@ spec:
     # Per-pod scratch cache — RWO, disposable, one PVC per replica.
     - metadata:
         name: cache
+        annotations:
+          # Exclude the per-pod cache PVCs from the jellyfin-config k8up Schedule
+          # (skipWithoutAnnotation is false cluster-wide). Cache is disposable and
+          # RWO — it would also fail to mount into the backup pod while in use.
+          k8up.io/backup: "false"
       spec:
         accessModes:
           - ReadWriteOnce