jellyfin: split media PVC into tv/movies on cephfs-raid5-delete

Separate tv and movies onto their own volumes so sonarr/radarr can each
mount and manage their library individually later, and move media storage
off cephfs-raid6-retain onto cephfs-raid5-delete.

- Remove single jellyfin-media PVC (RWX, cephfs-raid6-retain)
- Add jellyfin-media-tv and jellyfin-media-movies PVCs (RWX, cephfs-raid5-delete, 500Gi each, expandable)
- Mount tv read-only at /media/tv and movies read-only at /media/movies in the statefulset
- Update kustomization resources to reference the two new PVCs

apps/base/jellyfin/kustomization.yaml

@@ -9,7 +9,8 @@ resources:
   - cnpg_backup.yaml
   - pvc-config.yaml
   - pvc-transcode.yaml
-  - pvc-media.yaml
+  - pvc-media-tv.yaml
+  - pvc-media-movies.yaml
   - statefulset.yaml
   - pdb.yaml
   - service.yaml

apps/base/jellyfin/pvc-media-movies.yaml

@@ -0,0 +1,17 @@
+---
+# Movie library, shared read-many across replicas. Split out from the old single
+# media PVC so radarr can mount and manage movies independently. cephfs-raid5-delete
+# supports RWX and allows volume expansion; size is a starting point.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media-movies
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 500Gi
+  storageClassName: cephfs-raid5-delete
+  volumeMode: Filesystem

apps/base/jellyfin/pvc-media-tv.yaml

@@ -0,0 +1,17 @@
+---
+# TV library, shared read-many across replicas. Split out from the old single
+# media PVC so sonarr can mount and manage TV independently. cephfs-raid5-delete
+# supports RWX and allows volume expansion; size is a starting point.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-media-tv
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 500Gi
+  storageClassName: cephfs-raid5-delete
+  volumeMode: Filesystem

apps/base/jellyfin/pvc-media.yaml

@@ -1,17 +0,0 @@
----
-# Media library, shared read-many across replicas. Retain — this holds the
-# actual media and must survive PVC deletion. Empty on first deploy; populating
-# it is out of scope for this app.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-media
-  namespace: jellyfin
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Ti
-  storageClassName: cephfs-raid6-retain
-  volumeMode: Filesystem

apps/base/jellyfin/statefulset.yaml

@@ -207,8 +207,11 @@ spec:
               mountPath: /config/transcodes
             - name: cache
               mountPath: /cache
-            - name: media
-              mountPath: /media
+            - name: media-tv
+              mountPath: /media/tv
+              readOnly: true
+            - name: media-movies
+              mountPath: /media/movies
               readOnly: true
       volumes:
         - name: config
@@ -217,9 +220,12 @@ spec:
         - name: transcode
           persistentVolumeClaim:
             claimName: jellyfin-transcode
-        - name: media
+        - name: media-tv
           persistentVolumeClaim:
-            claimName: jellyfin-media
+            claimName: jellyfin-media-tv
+        - name: media-movies
+          persistentVolumeClaim:
+            claimName: jellyfin-media-movies
   volumeClaimTemplates:
     # Per-pod scratch cache — RWO, disposable, one PVC per replica.
     - metadata: