redact: scrub leaked Jellyfin admin API token from public repo

Token 76858153...f8b1 was committed across 9 docs + 1 snapshot RESTORE.md
and exposed via the brief public window of this repo. Replaced with
`<JELLYFIN_API_TOKEN>` placeholder.

WARNING: this commit only redacts HEAD — the token remains in git history.
Anyone who cloned during the public window has the full value. Treat the
old token as compromised and rotate at Jellyfin Dashboard > API Keys.
Original value backed up to private s8n/secrets/ARRFLIX/.

docs/01-artwork-and-images.md

@@ -10,7 +10,7 @@ nullstone). Auth header below uses the long-lived API token — replace with you
 own `X-Emby-Token` if needed.
 
 ```bash
-TOKEN="*redacted*"
+TOKEN="<JELLYFIN_API_TOKEN>"
 H="-H \"Authorization: MediaBrowser Token=${TOKEN}\""
 BASE="https://arrflix.s8n.ru"
 ```

docs/02-metadata-and-titles.md

@@ -203,7 +203,7 @@ For our Futurama set, all files are single-episode (`s01e01.pl.mkv`), so this di
 Step-by-step, with the exact commands run:
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 SERIES_ID=156e57437f795e5c8cd80fc98bafaee0   # Futurama
 LIB_ID=767bffe4f11c93ef34b805451a696a4e      # TV Shows library
 

docs/03-subtitles.md

@@ -90,7 +90,7 @@ User does NOT need to obtain an API key. The plugin embeds its own key (verified
 After signup at opensubtitles.com, save creds via API:
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 USER='your-opensubtitles-com-username'
 PASS='your-opensubtitles-com-password'
 

docs/04-theming-and-users.md

@@ -129,7 +129,7 @@ Rollback paths:
 ### Branding API (Cineplex, applied 2026-05-08)
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 
 cat > /tmp/branding.json <<'EOF'
 {
@@ -558,7 +558,7 @@ to `/System/Configuration/branding`.
 > friend account that will exist later.
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 TVSHOWS_ID=767bffe4f11c93ef34b805451a696a4e
 
 # 1. Create the user (auth header REQUIRED — admin token).

docs/05-file-structure-rules.md

@@ -968,7 +968,7 @@ used at library creation.)
 ### 12.1 Creating libraries via API
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 H="-H \"X-Emby-Token: ${TOKEN}\""
 B="https://arrflix.s8n.ru"
 

docs/06-per-library-themes.md

@@ -55,7 +55,7 @@ information needed to scope styles is simply not in the DOM.
 
 ### Why approach #3 fails
 
-`GET /Library/VirtualFolders` (auth `X-Emby-Token: *redacted*`) returns
+`GET /Library/VirtualFolders` (auth `X-Emby-Token: <JELLYFIN_API_TOKEN>`) returns
 `LibraryOptions` containing only metadata/scan/subtitle settings. No `CustomCss`, no `Theme`, no
 `Branding` per library. The single global CustomCss field at `/System/Configuration/branding` is the
 only knob the server exposes.

docs/12-dev-instance.md

@@ -62,7 +62,7 @@ When a dev theme is "shipped":
 2. **POST to prod**:
    ```bash
    curl -k -X POST \
-     -H "X-Emby-Token: *redacted*" \
+     -H "X-Emby-Token: <JELLYFIN_API_TOKEN>" \
      -H "Content-Type: application/json" \
      --data @/tmp/branding.json \
      https://arrflix.s8n.ru/System/Configuration/branding

docs/15-force-english.md

@@ -84,7 +84,7 @@ of `add-jellyfin-user.sh` already uses.
 **Reference curl** (single user, marco):
 
 ```bash
-TOKEN=*redacted*
+TOKEN=<JELLYFIN_API_TOKEN>
 USER_ID=d787fbfc373a44119a247e7406b2721e
 curl -s "https://arrflix.s8n.ru/Users/$USER_ID" \
   -H "Authorization: MediaBrowser Token=$TOKEN" > /tmp/u.json
@@ -170,7 +170,7 @@ That is a one-line addition; the rest of the wrapper is untouched.
 1. Review this doc and `bin/force-english-all-users.sh`.
 2. Run the script with the admin token in env:
    ```
-   JELLYFIN_TOKEN=*redacted* bin/force-english-all-users.sh
+   JELLYFIN_TOKEN=<JELLYFIN_API_TOKEN> bin/force-english-all-users.sh
    ```
 3. Hard-refresh each browser (Ctrl-Shift-R) to clear any cached locale
    bundle the SPA loaded on previous visit.

snapshots/2026-05-08-pre-elegantfin/RESTORE.md

@@ -33,7 +33,7 @@ User IDs captured:
 
 ```bash
 SNAP=/tmp/ARRFLIX/snapshots/2026-05-08-pre-elegantfin
-TOKEN="*redacted*"
+TOKEN="<JELLYFIN_API_TOKEN>"
 BASE="https://arrflix.s8n.ru"
 ```
 
@@ -76,7 +76,7 @@ done
 
 ```bash
 SNAP=/tmp/ARRFLIX/snapshots/2026-05-08-pre-elegantfin
-TOKEN="*redacted*"
+TOKEN="<JELLYFIN_API_TOKEN>"
 BASE="https://arrflix.s8n.ru"
 
 # 1. branding