Strengthens report §8: beyond the RBAC can-i output already cited, checked
(1) create verbs for jobs/pods and secrets read access (all no), (2) VM
for any jellyfin/session/transcode-named metric series (none exist), and
(3) Jellyfin's own API directly (public info reachable, /Sessions
correctly 401s without a key this session doesn't have). Confirms the
live transcode-under-load validation gap is a hard, verified constraint,
not an unexplored option.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
3c6301d581