fix(jellyfin): use compose default-substitution so validator passes

Without a .env in the jellyfin app dir, validate-catalog.py's
\`docker compose config\` step substituted \${MEDIA_PATH} → empty →
\`:/media:ro\` which compose rejects ("empty section between colons"),
failing CI on every post-Jellyfin commit. Local runs skipped the
check because the validator gates it on \`which docker\` and my dev
box has none.

Fix: use the default-substitution form \${MEDIA_PATH:-/nonexistent}.
Empty/unset MEDIA_PATH now expands to /nonexistent — valid volume
spec, CI green. Real install flow (form fill → .env with real path)
substitutes the user value as before. /nonexistent is obviously
wrong, so if a broken install path ever reaches \`docker compose up\`
the mount fails loudly rather than silently mounting something
random.

Doesn't affect the already-published 26.10-alpha catalog tarball —
that one works end-to-end for the Web UI install flow. This fix is
purely to un-red CI on subsequent pushes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/jellyfin/docker-compose.yaml

@@ -10,6 +10,15 @@
 # the directory exists and isn't a system path, and docker-compose
 # substitutes the value below at `docker compose up` time.
 #
+# The `${MEDIA_PATH:-/nonexistent}` default-substitution keeps
+# `validate-catalog.py` (which runs `docker compose config` without any
+# .env) from failing on the empty-string case: an empty MEDIA_PATH
+# would expand to `:/media:ro` which compose rejects as "empty section
+# between colons". /nonexistent is an obviously-wrong fallback so if it
+# ever actually reaches `docker compose up` (which requires a broken
+# install flow), the mount fails loudly instead of silently mounting
+# something random.
+#
 # TODO(image-pin): `:latest` is shaky for production — pin to a digest
 # (`jellyfin/jellyfin@sha256:...`) or a stable tag once we've verified
 # one against the upstream registry. MVP drift risk accepted.
@@ -29,7 +38,7 @@ services:
     volumes:
       - furtka_jellyfin_config:/config
       - furtka_jellyfin_cache:/cache
-      - ${MEDIA_PATH}:/media:ro
+      - ${MEDIA_PATH:-/nonexistent}:/media:ro
 
 volumes:
   furtka_jellyfin_config: