Add stream.carloselugo.com Caddy block for Jellyfin

Reverse-proxies to the jellyfin container over web_web-net, with
buffering disabled for WebSocket/streaming and X-Frame-Options set
to SAMEORIGIN instead of the default DENY.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Caddyfile

@@ -202,3 +202,22 @@ fotos.carloselugo.com {
         format json
     }
 }
+
+# ── Jellyfin — stream.carloselugo.com ──────────────────────────────────────────
+stream.carloselugo.com {
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+        -Server
+    }
+    reverse_proxy jellyfin:8096 {
+        flush_interval -1
+    }
+    encode gzip
+    log {
+        output file /var/log/caddy/jellyfin.log
+        format json
+    }
+}