[codex] Align media services with live routing

[ironicbadger]

Summary

This PR aligns the media service routing/configuration with the live infrastructure state.

Changes include:

• Update AdGuard Home rewrites for the current media/app routing targets.
• Add the *.demo.ktz.me Caddy wildcard endpoint for the Jellyfin demo route.
• Make Storyteller book and audiobook mounts writable instead of read-only.
• Remove retired Tautulli and Plex compose entries that are no longer running.

Why

These changes were split out from the local LLM/Hermes branch because they are actual infra/media routing fixes and should be reviewed independently from the Framework LLM work.

Impact

• Keeps DNS/Caddy routing in Git aligned with the live core/appnv state.
• Prevents retired Plex/Tautulli services from being redeployed by compose generation.
• Allows Storyteller to write to its book/audiobook mounts where needed.

Validation

• git diff --check main..HEAD
• ansible-playbook --syntax-check run.yaml
• ansible-inventory --graph
• GitHub compare confirms this branch is 1 commit ahead of main and touches only the expected media/routing files.

Known warning: Ansible still reports the existing ktz-cloud group/host name warning; this PR does not introduce it.