jellyfin sidecar: server registry, video façade and byte pass-through

officer-jellyfin owns the whole Jellyfin contract: the instance URL, the access
token, the Jellyfin user it belongs to and the DeviceId its sessions are keyed
by. The platform side is a 17-line proxy holding no credentials.

Servers are a registry, not a single row — this machine runs four instances and
the owner switches between them. The password is never stored: it is traded once
for an access token through AuthenticateByName, and only that token is persisted,
encrypted.

Two doors. /_officer/* is a hand-written JSON façade for the things the browser
should not have to know — the user id in the path, the Fields lists that decide
whether a grid has posters, the PlaybackInfo negotiation. /_jf/* is a GET-only,
allow-listed byte pass-through for images, video, HLS and subtitles; it keeps
Jellyfin's own paths because a master playlist references its segments
relatively, so any renaming would mean rewriting m3u8 bodies.

TranscodingUrl arrives with api_key=<access token> in its query string and would
otherwise be handed straight to a video element. It is stripped before anything
is returned; the pass-through re-adds the credential as a header.

Video only — Officer's own player owns audio, so music collections are filtered
out of the library list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ecosystem.config.cjs

@@ -92,6 +92,15 @@ module.exports = {
       args: 'run src/servers/sidecar/invoiceshelf/index.ts',
       watch: false,
     },
+    // Video. Wraps a self-hosted Jellyfin. Servers, and the access token each one is signed in with, are set
+    // by the owner from /jellyfin and stored encrypted in `jellyfin_servers` — read here, never from the
+    // environment. Video only: Officer's own player owns audio.
+    {
+      name: 'officer-jellyfin',
+      script: 'bun',
+      args: 'run src/servers/sidecar/jellyfin/index.ts',
+      watch: false,
+    },
     // Notes. Wraps a self-hosted Memos. The instance URL and its personal access token are set by the
     // owner from the UI and stored in `service_connections` — read here, never from the environment.
     {