nuc: media over NFS from nas, on-demand role, i915 and input traps

nuc keeps only what needs its iGPU. blocky, privoxy and transmission-bt
moved to nas so the box can be powered off when not watching Jellyfin or
using the Spotify kiosk.

- /srv/media is now an NFSv4 mount from nas; jellyfin-server reads it
  with shift=false (idmapped mounts are unsupported on NFS, as the
  container doc already noted for CIFS) and readonly=true
- replication to nas is a systemd timer with Persistent=true, not cron —
  an on-demand host misses its 03:30 window and cron cannot catch up

Two failures documented in full, both diagnosed from the wrong layer
first:

- booting with the TV connected and powered on kills the i915 probe
  (drm_WARN_ON in intel_modeset_setup_hw_state), so /dev/dri never
  appears, snd_hda_intel deferred-probes forever holding the PCI device
  lock, and incusd blocks in sriov_numvfs_show — no container starts at
  all, including LAN DNS. Identical on 6.12.107 and 6.12.105.
- the kiosk input gid mismatch is real but was NOT the cause of the
  2026-08-30 outage (flat K400 batteries were); seatd opens input devices
  as root, so kiosk group membership is not on that path. Records the
  one-line raw capture that settles hardware-vs-software immediately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nuc/jellyfin-server.md

@@ -5,8 +5,10 @@ Jellyfin media **server** in an unprivileged Incus container on `nuc`.
 - Image: `images:ubuntu/24.04`, Jellyfin from the official repo (repo.jellyfin.org)
 - IP: `192.168.0.5` (LAN bridge) — web UI/API on `http://192.168.0.5:8096`
 - iGPU render node (`/dev/dri/renderD128`) passed for QSV/VAAPI hardware transcoding
-- Media library: host `/srv/media` (ZFS dataset `usb4t/media`, USB 4 TB)
-  mounted at `/media` with `shift=true` (needs ZFS ≥ 2.2 for idmapped mounts)
+- Media library: host `/srv/media` — since 2026-08-30 an **NFSv4 mount
+  from `nas`** (`192.168.0.4:/media`, dataset `tank/media`), mounted at
+  `/media` in the container with **`shift=false`** and `readonly=true`.
+  See [nas/nas-install.md](../nas/nas-install.md) §8.
 - Port 8096 additionally proxied to the host address (`web` proxy device)
 
 ## Install script
@@ -77,6 +79,43 @@ incus restart "$CNAME"
 echo "Done. Open http://<host-ip>:8096 to run the setup wizard."
 ```
 
+## Media over NFS (2026-08-30)
+
+The library moved to `nas` when the 4 TB left nuc's USB enclosure. The
+container keeps the same path, so everything below still applies — only
+the mount underneath `/srv/media` changed.
+
+```sh
+# nuc host: /etc/fstab
+192.168.0.4:/media /srv/media nfs4 ro,_netdev,soft,timeo=100,retrans=3 0 0
+```
+
+`shift=true` **cannot** be used: idmapped mounts are not supported on
+NFS (nor CIFS). Per the troubleshooting note below, dropping the shift is
+enough for a read-only library — the export uses `all_squash` so files
+carry synthetic world-readable ownership:
+
+```sh
+incus stop jellyfin-server                 # shift cannot be hot-applied
+incus config device set jellyfin-server media shift=false
+incus config device set jellyfin-server media readonly=true
+incus start jellyfin-server
+```
+
+⚠️ Two traps:
+
+- **Boot ordering.** Add `remote-fs.target` to nuc's
+  `/etc/systemd/system/incus.service.d/after-zfs.conf`, or the container
+  starts against an empty mountpoint and Jellyfin shows an empty library
+  (and may prune the library metadata).
+- **`soft` is deliberate.** A hung nas should fail Jellyfin's reads, not
+  wedge nuc's processes in uninterruptible sleep the way the suspended
+  `usb4t` pool did ([usb4t-dropouts.md](usb4t-dropouts.md)).
+
+`transmission-bt` is no longer on nuc — it moved to nas and writes to
+the dataset locally ([nas/transmission-bt.md](../nas/transmission-bt.md)),
+so nuc's mount is read-only and there is exactly one writer.
+
 ## First-run configuration
 
 1. Run the setup wizard; add libraries pointing at `/media/...`.