yum: source AlmaLinux RPM repos from artifactapi, drop legacy unkin repo (#496)

AlmaLinux hosts still pulled in-house RPMs from the legacy `unkin` repo hosted on Gitea (git.query.consul), and a second legacy Gitea repo `unkinben` was enabled fleet-wide. This moves AlmaLinux hosts fully onto the artifactapi local rpm repos so all hosts get the in-house/vendored set for their EL release, matching the artifactapi-is-the-real-registry model already used for baseos/epel/etc., and removes both legacy Gitea yum repos.

Depends on unkin/terraform-artifactapi#15 (creates the general `rpm-vendor` local repo); that should apply before this reaches hosts.

### RPM source migration
- retarget `rpm-vendor` to the distribution-agnostic `local/rpm-vendor` repo
- add `rpm-internal-release`/`rpm-vendor-release`, resolved from `os.release.major` so el8 hosts pull `-el8`, el9 hosts `-el9`, etc.
- remove the legacy `unkin` yumrepo definition (its content now comes from rpm-internal/rpm-vendor)

### unkinben removal
- remove the `unkinben` yumrepo definition from `AlmaLinux/all_releases.yaml`
- remove the `unkinben` `ensure: present` override from the jellyfin media role (its only consumer)
- `purge => true` on the yum profile then cleans `/etc/yum.repos.d/unkin.repo` from hosts

**Heads-up for reviewer:** the jellyfin role installs `jellyfin-web`, `jellyfin-server`, and `jellyfin-ffmpeg-bin` from unkinben. These packages exist **only** in unkinben, so once it is removed they will remain installed but **stop receiving updates** until they are republished into artifactapi (e.g. `rpm-internal-elN`). Jellyfin's other deps (`SDL2`, `ffmpeg`, `ffmpeg-devel`) come from rpmfusion and are unaffected. The `unkinben` *generic* archive downloads used by the *arr modules (sonarr/radarr/prowlarr/lidarr/readarr) and glauth are direct HTTP fetches, not the yum repo, and are untouched.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #496
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

hieradata/os/AlmaLinux/all_releases.yaml

@@ -70,14 +70,6 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
-  unkinben:
-    name: unkinben
-    descr: unkinben repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkinben/rpm/el%{facts.os.release.major}
-    gpgkey: https://git.query.consul/api/packages/unkinben/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent
   rpm-internal:
     name: rpm-internal
     descr: rpm-internal repository
@@ -89,6 +81,22 @@ profiles::yum::global::repos:
     name: rpm-vendor
     descr: rpm-vendor repository
     target: /etc/yum.repos.d/rpm-vendor.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+    gpgcheck: false
+    mirrorlist: absent
+  # Per-release variants, resolved from the host's EL major version so el8
+  # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
+  rpm-internal-release:
+    name: rpm-internal-el%{facts.os.release.major}
+    descr: rpm-internal-el%{facts.os.release.major} repository
+    target: /etc/yum.repos.d/rpm-internal-release.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
+    gpgcheck: false
+    mirrorlist: absent
+  rpm-vendor-release:
+    name: rpm-vendor-el%{facts.os.release.major}
+    descr: rpm-vendor-el%{facts.os.release.major} repository
+    target: /etc/yum.repos.d/rpm-vendor-release.repo
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
@@ -274,11 +282,3 @@ profiles::yum::global::repos:
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
     gpgcheck: 1
     mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent

hieradata/roles/apps/media/jellyfin.yaml

@@ -57,5 +57,3 @@ profiles::yum::global::repos:
     ensure: present
   rpmfusion-nonfree:
     ensure: present
-  unkinben:
-    ensure: present