jupiter: VAAPI hardware transcoding for jellyfin, move heavy state off the eMMC

Enables hardware.graphics + intel-media-driver for the Apollo Lake's
Gen9 iGPU (VAAPI only — QSV needs an insecure/EOL runtime on this
chip) and adds jellyfin's service user to video/render for the DRI
card node. 4K HDR still can't be tone-mapped on this hardware; those
files need to direct-play or be kept as 1080p SDR.

Also relocates podman's container storage and immich's postgres
cluster to /mnt/data/AppData, after a deploy holding two ~9G closures
at once filled the 29G eMMC and postgres died mid-write.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

services/media/jellyfin.nix

@@ -6,7 +6,14 @@
     dataDir = "/mnt/data/AppData/jellyfin";
     cacheDir = "/mnt/data/AppData/jellyfin/cache";
   };
-  users.users.jellyfin.extraGroups = [ "users" ];
+  # "users" so the shared library stays readable (see the UMask note below);
+  # "video"/"render" for the DRI nodes used by hardware transcoding. renderD128
+  # happens to be 0666 so VAAPI alone would work without this, but card1 is
+  # 0660 root:video — and neither mode is guaranteed, so don't rely on it. The
+  # groups are harmless on a host with no GPU: they exist regardless, and this
+  # module stays host-agnostic (the DRIVER is enabled per-host, e.g. jupiter's
+  # hardware.graphics + intel-media-driver).
+  users.users.jellyfin.extraGroups = [ "users" "video" "render" ];
 
   # The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
   # trickplay thumbnails into stray new show folders it invented itself,