Nest media groups into akR-global-admin

Global admins get akP-jellyfin-admin but no path to a jellyfin-bound
group, so Authentik denies them at the application gate. Add
akP-media-fafflix and akP-media-cheeztv to reach it.

config/roles/akR-global-admin.yaml

@@ -1,4 +1,6 @@
 # Role akR-global-admin (name = filename): full admin across all onboarded apps.
+# Nests akP-media-fafflix / akP-media-cheeztv so admins pass the jellyfin
+# application gate and can reach the akP-jellyfin-admin rights nested below.
 permissions:
   - akP-grafana-admin
   - akP-argocd-admin
@@ -17,3 +19,5 @@ permissions:
   - akP-arrstack-sonarr
   - akP-arrstack-radarr
   - akP-arrstack-prowlarr
+  - akP-media-fafflix
+  - akP-media-cheeztv