Port MediaServer appliance to TurnKey 19 - #33

Firstboot removes Jellyfin's one-use bootstrap secret, so runtime acceptance must authenticate with the application password supplied by the harness. Require that credential and write the seven evidence fields to the required result file so the harness can evaluate the appliance run.

Firstboot previously passed the administrator password with --pass, making it visible to local process inspection while Jellyfin was configured. Add an explicit standard-input mode and use it from the firstboot hook while retaining the interactive and command-line interfaces for compatibility.

Verified with shell syntax, Python bytecode compilation, argument parsing, a focused stdin invocation, and git diff checks.

Jellyfin's health endpoint becomes successful before the startup wizard API is ready, allowing the build to reach configuration while the server still returns HTTP 503. Gate setup on the actual Startup/Configuration endpoint so the normal administrator and library initialization begins only when its dependency is available.

The failure was reproduced by exact run 20260826t152259z-1151-25306. Bash syntax and whitespace checks pass.

The setup API correctly returns a transient HTTP 503 while Jellyfin finishes starting, and the readiness loop handles that response. Suppress stderr for the handled retry so the acceptance log scanner does not misclassify a later successful build as failed.

Exact run 20260826t153404z-7557-28310 completed the product build and setup before the log-only rejection. Bash syntax and whitespace checks pass.

MediaServer does not install PHP, but its Makefile still invoked the shared PHP configuration script. That pass attempted to query a missing php binary, emitted a handled command-not-found diagnostic, and caused exact acceptance to reject an otherwise successful build.

Removing the unused include leaves the fileserver and Jellyfin integration unchanged and keeps the build log truthful. Verified the plan and Makefile no longer request PHP configuration and passed whitespace checks.

Replace the stale preflight-only state with the passing exact run, tested source commit, retained report digest, runtime behavior, and product-loop accounting. This makes the PR evidence traceable without changing the exact-tested appliance.