nuc: media over NFS from nas, on-demand role, i915 and input traps

nuc keeps only what needs its iGPU. blocky, privoxy and transmission-bt
moved to nas so the box can be powered off when not watching Jellyfin or
using the Spotify kiosk.

- /srv/media is now an NFSv4 mount from nas; jellyfin-server reads it
  with shift=false (idmapped mounts are unsupported on NFS, as the
  container doc already noted for CIFS) and readonly=true
- replication to nas is a systemd timer with Persistent=true, not cron —
  an on-demand host misses its 03:30 window and cron cannot catch up

Two failures documented in full, both diagnosed from the wrong layer
first:

- booting with the TV connected and powered on kills the i915 probe
  (drm_WARN_ON in intel_modeset_setup_hw_state), so /dev/dri never
  appears, snd_hda_intel deferred-probes forever holding the PCI device
  lock, and incusd blocks in sriov_numvfs_show — no container starts at
  all, including LAN DNS. Identical on 6.12.107 and 6.12.105.
- the kiosk input gid mismatch is real but was NOT the cause of the
  2026-08-30 outage (flat K400 batteries were); seatd opens input devices
  as root, so kiosk group membership is not on that path. Records the
  one-line raw capture that settles hardware-vs-software immediately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nuc/nuc-install.md

@@ -265,6 +265,13 @@ Both logs rotate monthly (`/etc/logrotate.d/incus-*`).
       the install scripts in the per-container docs include it)
 - [ ] Host boots to `multi-user.target`, nothing grabs the GPU
       (required by the jellyfin-client kiosk)
+- [ ] ⚠️ **Reboot with the TV/projector disconnected or powered off.**
+      Booting with the display active kills the i915 probe, which wedges
+      `snd_hda_intel` in a deferred probe, which blocks incusd in
+      `sriov_numvfs_show` — **no container starts at all, including
+      blocky/DNS**. Hotplug the cable back after boot, then
+      `incus exec jellyfin-client -- systemctl restart jellyfin-kiosk`.
+      Full diagnosis: [jellyfin-client.md](jellyfin-client.md)
 - [ ] Jellyfin web at `http://192.168.0.5:8096`, kiosk UI on HDMI,
       sound on the Pioneer, "Pioneer A-70" visible in Spotify Connect
 - [ ] LAN DNS: clients use blocky at `192.168.0.254` (host itself uses