jellyfin, extracted into plugins/jellyfin — the platform half

Eighth extraction, second resurrection. Same shape as soulseek: hono.ts had the
router import and its PROTECTED_MOUNTS entry commented out since 2026-08-13 and
the permission reduced to api: [], so assertPermissionTotality was satisfied,
the server booted clean, and every panel request 404'd. Also closes the same
data hazard — jellyfin_servers was absent from the drizzle barrel, so bun
db:push would have dropped it.

No frontend call site needed repointing: mountPrefix derives /jellyfin from the
appName, which is what the router already hardcoded.

Test fixtures fixed properly rather than re-anchored again. Extracting jellyfin
broke 18 tests, the FOURTH extraction in a row to break the same files — photos
and transmission yesterday, slskd an hour ago, jellyfin now. installer.test.ts
now builds literal CatalogueEntry fixtures and asks the catalogue nothing: it
pins planSteps and runInstall, which are installer logic, and a service leaving
for plugins/ says nothing about whether the installer still plans the right
steps. catalogue.test.ts stays the place real entries are checked well-formed.
members/catalogue/preflight re-anchored to memos, which has jellyfin's exact
shape.

The .prettierignore rule for the vendored hls.mjs moved into the plugin rather
than being left behind naming a deleted path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/theme-baseline.json

@@ -10,7 +10,6 @@
   "src/workspaces/officerdev/src/apps/FileBrowser": 15,
   "src/workspaces/officerdev/src/apps/FileViewer": 38,
   "src/workspaces/officerdev/src/apps/Invoices": 95,
-  "src/workspaces/officerdev/src/apps/Jellyfin": 48,
   "src/workspaces/officerdev/src/apps/Preview": 4,
   "src/workspaces/officerdev/src/apps/QrTransfer": 5,
   "src/workspaces/officerdev/src/apps/SystemMonitor": 1,