Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/media/tasks/configure.yml

@@ -0,0 +1,33 @@
+---
+# Jellyfin service configuration
+
+- name: Create media library directory
+  file:
+    path: "{{ jellyfin_library }}"
+    state: directory
+    owner: jellyfin
+    group: jellyfin
+    mode: "0755"
+
+- name: Ensure Jellyfin binds to localhost only
+  lineinfile:
+    path: /etc/jellyfin/network.xml
+    regexp: '<LocalNetworkAddresses>'
+    line: '    <LocalNetworkAddresses><string>127.0.0.1</string></LocalNetworkAddresses>'
+    create: true
+    mode: "0644"
+  notify: restart jellyfin
+  failed_when: false
+
+- name: Enable and start Jellyfin service
+  service:
+    name: jellyfin
+    state: started
+    enabled: true
+
+- name: Wait for Jellyfin to be ready
+  wait_for:
+    port: 8096
+    host: 127.0.0.1
+    delay: 5
+    timeout: 60