Merge pull request 'feat: migrate seerr from fallenbagel/jellyseerr:preview-OIDC -> seerr-team/seerr:v3.3.0' (#88) from feat/seerr-migrate-to-seerr-team into main

Switching from the third-party OIDC-capable jellyseerr fork to the
mainline successor project (Seerr - the combined Overseerr+Jellyseerr
team rebrand, v3.0.0 / Feb 2026 onward). Mainline now has native OIDC
support so the custom preview-OIDC build isn't needed.

  - Image    : docker.io/fallenbagel/jellyseerr:preview-OIDC
              -> ghcr.io/seerr-team/seerr:v3.3.0 (Jun 2, 2026)
  - Migration: automatic on first start per docs.seerr.dev/migration-guide;
              existing sqlite db + settings.json in /app/config are
              directly compatible. v3.1.x added CVE-2026-40175 fix +
              auth-related security patches, so v3.3.0 is the right
              floor anyway.
  - Backup   : ~/seerr-backups/seerr-config-20260606-153633.tar.gz on
              dooplex (covers db.sqlite3 + settings.json + logs).
              Rollback = revert image + restore tarball into the PVC.

Worth verifying after rollout:
  - Pod becomes Ready (readiness probe path /api/v1/status -- should
    still exist in seerr).
  - Authentik OIDC sign-in still works. If the custom build used
    different config keys than mainline seerr expects, OIDC may need
    re-configuration in the seerr UI (Authentik side unchanged).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

servarr-system/servarr.yaml

@@ -904,7 +904,14 @@ spec:
     spec:
       containers:
         - name: seerr
-          image: docker.io/fallenbagel/jellyseerr:preview-OIDC
+          # 2026-06-06: migrating from fallenbagel/jellyseerr:preview-OIDC
+          # (a custom OIDC-capable build) to seerr-team/seerr v3.x — the
+          # successor project (combined Overseerr+Jellyseerr team rebrand
+          # from v3.0.0). Mainline now has native OIDC support so we don't
+          # need the custom build. Migration is auto on first start; backed
+          # up the config PVC to ~/seerr-backups on dooplex before this PR.
+          # https://docs.seerr.dev/migration-guide
+          image: ghcr.io/seerr-team/seerr:v3.3.0
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

workout-system/sparkyfitness.yaml

@@ -144,8 +144,10 @@ spec:
         app.kubernetes.io/instance: sparkyfitness
         app.kubernetes.io/name: server
       annotations:
-        # Tag format is vMAJOR.MINOR.PATCH.BUILD (e.g. v0.16.6.3)
-        match-regex.version-checker.io/server: '^v\d+\.\d+\.\d+\.\d+$'
+        # Tag format used to be vMAJOR.MINOR.PATCH.BUILD (e.g. v0.16.6.3),
+        # changed to vMAJOR.MINOR.PATCH on 2026-06-01 (v0.16.7+). Accept
+        # both so historical comparisons + new releases both match.
+        match-regex.version-checker.io/server: '^v\d+\.\d+\.\d+(\.\d+)?$'
     spec:
       enableServiceLinks: false
       securityContext:
@@ -166,7 +168,7 @@ spec:
               echo "PostgreSQL is ready!"
       containers:
         - name: server
-          image: codewithcj/sparkyfitness_server:v0.16.6.3
+          image: codewithcj/sparkyfitness_server:v0.16.8
           env:
             # ---- Database (owner / superuser role, used for migrations) ----
             - name: SPARKY_FITNESS_DB_HOST
@@ -330,12 +332,12 @@ spec:
         app.kubernetes.io/instance: sparkyfitness
         app.kubernetes.io/name: frontend
       annotations:
-        match-regex.version-checker.io/frontend: '^v\d+\.\d+\.\d+\.\d+$'
+        match-regex.version-checker.io/frontend: '^v\d+\.\d+\.\d+(\.\d+)?$'
     spec:
       enableServiceLinks: false
       containers:
         - name: frontend
-          image: codewithcj/sparkyfitness:v0.16.6.3
+          image: codewithcj/sparkyfitness:v0.16.8
           env:
             - name: SPARKY_FITNESS_SERVER_HOST
               value: "sparkyfitness-server"