Picks up cross-replica auth read-through, bare Jellyfin__ env config,
the min(uuid) anti-join fix for browse/search/Recently Added, and
scan-leader gating tied to Redis configuration.
v0.3.0 shipped a regenerated initial migration that broke upgrades
on existing Postgres databases. Pin the fork commit restoring the
baseline plus forward migrations and the EncoderPreset fallback.
- pin UPSTREAM_REF to the v12.0 rebase commit
- move publish to dotnet SDK 10.0 and the runtime to aspnet:10.0
- pin jellyfin-web to 12.0+deb12
- bake LDAP Authentication 24.0.0.0 (targetAbi 12.0.0.0)
- build PR images with the CA-baked buildx plugin