Roll jellyfin-ha to v0.3.3 and drop Service affinity

SSO login fails across replicas with "Invalid or expired state": the SSO
plugin kept OAuth state in-process, so /sso/OID/start and the IdP callback
could land on different pods. v0.3.3 ships the forked plugin backing that
state with Valkey.

- bump cheeztv and fafflix to jellyfin-ha:v0.3.3
- remove sessionAffinity: ClientIP from both Services

apps/base/cheeztv/service.yaml

@@ -13,6 +13,4 @@ spec:
       targetPort: http
   selector:
     app: cheeztv
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
   type: ClusterIP

apps/base/cheeztv/statefulset.yaml

@@ -164,7 +164,7 @@ spec:
               readOnly: true
       containers:
         - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

apps/base/fafflix/service.yaml

@@ -13,6 +13,4 @@ spec:
       targetPort: http
   selector:
     app: fafflix
-  # Pin each client to one replica to reduce transcode-session churn/takeover.
-  sessionAffinity: ClientIP
   type: ClusterIP

apps/base/fafflix/statefulset.yaml

@@ -164,7 +164,7 @@ spec:
               readOnly: true
       containers:
         - name: fafflix
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.3.3
           imagePullPolicy: IfNotPresent
           ports:
             - name: http