jellyfin: make Valkey HA (#375)

Jellyfin runs 2 replicas that coordinate distributed transcoding through the operator-managed `jellyfin-valkey` ValkeyCluster, but it was single-instance (shards:1, replicas:0) with no failover, so a node/pod loss would drop the shared transcode-lease state. This promotes that store to an HA topology.

Changes:
- Set replicas:2 (shards:1 unchanged) so the shard group is one primary + two replicas; losing the primary triggers an automatic in-cluster failover to a replica.
- Add scheduling.node.spread.shard.mode:Required so the three ValkeyNodes land on distinct hosts (kubernetes.io/hostname anti-affinity) and one host loss removes at most one node.
- Set podDisruptionBudget.mode:Cluster so the operator manages a quorum-aware PDB.
- Keep persistence omitted (emptyDir): lease state is ephemeral (30s TTLs), replication+failover already provide redundancy and a replaced node re-syncs from the primary, and an operator-managed PVC cannot carry the k8up.io/backup:"false" annotation the namespace k8up Schedule needs to skip in-use RWO volumes.
- Bump per-node memory limit to 512Mi (unchanged) / requests unchanged; resources are per ValkeyNode.

Connection string is unchanged: still cluster-mode via the single headless service `valkey-jellyfin-valkey:6379`; StackExchange.Redis seeds off it and auto-discovers topology and failovers.

kustomize build --enable-helm apps/overlays/au-syd1/jellyfin renders cleanly; pre-commit passes.

Reviewed-on: #375
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/jellyfin/valkey.yaml

@@ -1,14 +1,21 @@
 ---
-# Single-instance Valkey managed by valkey-operator, replacing the self-managed
+# HA Valkey managed by valkey-operator as Jellyfin's distributed transcode-session
-# redis Deployment as Jellyfin's distributed transcode-session store. shards:1 +
+# store. shards:1 + replicas:2 is one primary with two replicas in a single shard
-# replicas:0 is one primary with no replicas. This operator always runs Valkey
+# group (three ValkeyNodes total): losing the primary triggers an automatic
-# cluster-mode-enabled with protected-mode off and leaves the built-in `default`
+# failover to a replica, so a node/pod loss no longer drops the shared transcode
-# user passwordless, so clients connect with no auth/TLS (parity with the old
+# lease state the two Jellyfin replicas coordinate through. The operator always
-# open redis); StackExchange.Redis auto-discovers the single node. HA (more
+# runs Valkey cluster-mode-enabled with protected-mode off and leaves the built-in
-# shards/replicas) is a follow-up. Persistence is intentionally omitted so /data
+# `default` user passwordless, so clients connect with no auth/TLS (parity with the
-# is an emptyDir: the lease state is ephemeral, and the operator-managed PVC
+# old open redis); StackExchange.Redis seeds off the single headless service and
-# cannot carry the k8up.io/backup:"false" annotation the namespace's cluster-wide
+# auto-discovers the topology plus failovers, so the connection string is
-# k8up Schedule needs to skip an in-use RWO volume.
+# unchanged. scheduling.node.spread.shard:Required renders pod anti-affinity that
+# keeps the three nodes on distinct hosts (kubernetes.io/hostname), so one host
+# loss removes at most one node. podDisruptionBudget.mode:Cluster lets the operator
+# manage a quorum-aware PDB. Persistence stays omitted so /data is an emptyDir:
+# lease state is ephemeral (30s TTLs), replication+failover already provide
+# redundancy and a replaced node re-syncs from the primary, and an operator-managed
+# PVC cannot carry the k8up.io/backup:"false" annotation the namespace's
+# cluster-wide k8up Schedule needs to skip in-use RWO volumes.
 apiVersion: valkey.io/v1alpha1
 kind: ValkeyCluster
 metadata:
@@ -16,10 +23,17 @@ metadata:
   namespace: jellyfin
 spec:
   shards: 1
-  replicas: 0
+  replicas: 2
   image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
   exporter:
     enabled: false
+  scheduling:
+    node:
+      spread:
+        shard:
+          mode: Required
+  podDisruptionBudget:
+    mode: Cluster
   resources:
     requests:
       cpu: 50m