Working NixOS port: all core services operational

- Fix Caddy cfProxy helper for cloudflared http:// vhosts (X-Forwarded-Proto)
- Fix Authelia LDAP bind (readonly user ACL + password sync)
- Add gitea-admin-setup oneshot service to survive rebuilds
- Update Authelia forward_auth with header_up X-Forwarded-Proto https
- Update TODO.org with completed tasks and LDAP config details
- Remove old Helm/k8s artifacts (Chart.yaml, templates/, values/, scripts)
- Add result to .gitignore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/services/jellyfin.nix

@@ -30,7 +30,7 @@ in
   config = lib.mkIf cfg.enable {
     virtualisation.oci-containers.containers.jellyfin = {
       image = cfg.image;
-      ports = [ "127.0.0.1:${toString cfg.port}:8096" ];
+      # No ports mapping — --network=host shares the host network stack directly.
 
       environment = {
         JELLYFIN_PublishedServerUrl = "https://jellyfin.${domain}";