build: track jellyfin v12.0

- pin UPSTREAM_REF to the v12.0 rebase commit
- move publish to dotnet SDK 10.0 and the runtime to aspnet:10.0
- pin jellyfin-web to 12.0+deb12
- bake LDAP Authentication 24.0.0.0 (targetAbi 12.0.0.0)
- build PR images with the CA-baked buildx plugin

README.md

@@ -4,12 +4,12 @@ Build-orchestration repo for [ZoltyMat/jellyfin-ha](https://github.com/ZoltyMat/
 that adds distributed, Redis-backed transcoding for multi-pod Kubernetes (lease-aware cleanup, HA session
 takeover, optional PostgreSQL).
 
-This repo does **not** vendor the fork's source. It pins an upstream commit, builds the .NET 9 server, and
+This repo does **not** vendor the fork's source. It pins an upstream commit, builds the .NET 10 server, and
 produces a runtime container image pushed to the Gitea registry.
 
 ## What it produces
 
-`artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:9.0` based image with ffmpeg and
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:10.0` based image with ffmpeg and
 the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 
 ## Layout
@@ -34,7 +34,7 @@ the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 make build            # clones pinned upstream, dotnet publish, docker build
 ```
 
-Requires the .NET 9 SDK and Docker. `make publish` runs just the clone + publish into `./publish-output`.
+Requires the .NET 10 SDK and Docker. `make publish` runs just the clone + publish into `./publish-output`.
 
 ## Deployment