media: add full library folder structure, store all secrets in Vault

- external-secrets: add qbittorrent, jellyfin, seerr keys from Vault
- pvc: document all media folder paths (movies, tv, anime, docs, standup, concerts, kids, music)
- jellyfin: init container creates all media subdirs on startup

servers/legion/k8s/media/plex.yaml

@@ -28,6 +28,29 @@ spec:
       labels:
         app: jellyfin
     spec:
+      initContainers:
+        # Ensure all media subdirectories exist on the hostPath volume
+        - name: media-dirs
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p \
+                /media/movies \
+                /media/tv/shows \
+                /media/tv/anime \
+                /media/documentaries \
+                /media/standup \
+                /media/concerts \
+                /media/kids \
+                /media/music \
+                /media/downloads/complete \
+                /media/downloads/incomplete
+              chown -R 1000:1000 /media
+          volumeMounts:
+            - name: media
+              mountPath: /media
       containers:
         - name: jellyfin
           image: lscr.io/linuxserver/jellyfin:latest