SSO login fails across replicas with "Invalid or expired state": the SSO
plugin kept OAuth state in-process, so /sso/OID/start and the IdP callback
could land on different pods. v0.3.3 ships the forked plugin backing that
state with Valkey.
- bump cheeztv and fafflix to jellyfin-ha:v0.3.3
- remove sessionAffinity: ClientIP from both Services