Merge main and reconcile Atlas checklist

AGENTS.md

@@ -70,6 +70,8 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - Gitea cutover network configuration before activation:
     `ansible-playbook ansible/site.yml --limit prometheus --tags gitea_cutover,prometheus_backup --check --diff -e server_gitea_on_atlas=true`
     and `ansible-playbook ansible/site.yml --limit atlas --tags gitea --check --diff`
+  - Atlas daily Navidrome music copy:
+    `ansible-playbook ansible/site.yml --limit atlas --tags music_sync --check --diff`
   - Atlas network/share hardening:
     `ansible-playbook ansible/site.yml --limit atlas --tags hardening,sharing --check --diff`
   - Atlas ZFS snapshot retention and scrub timers:
@@ -177,7 +179,9 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `profile_backend_phase1` temporarily runs rootless Navidrome and Syncthing on Atlas until Uranus replaces
   them. It binds only to Atlas' LAN IP, never `wg0`; Navidrome and the Syncthing GUI admit only Aegis as
   the source-NAT gateway, while native Syncthing ports admit the configured LAN. It initializes fresh
-  state only and never migrates or deletes source application data.
+  state only and never migrates or deletes source application data. The enabled rootless
+  `atlas-music-sync.timer` copies `/zpool/archive/Music` to `/zpool/media/music` daily at 00:45
+  Europe/Rome without deleting destination files; it requires both datasets to be mounted.
 - `wireguard_overlay` manages `wg0` between Prometheus (`10.0.0.1`) and Aegis (`10.0.0.2`). It persists private
   keys only on their respective hosts, exchanges only derived public keys through Ansible, and verifies a real peer
   handshake. Prometheus opens `51820/udp`; Aegis is the LAN gateway. Its persistent IPv4 forwarding, narrowly scoped
@@ -266,13 +270,24 @@ successfully. The first monthly scrub remains a runtime check.
   files are deployed; live read-only SSH, shell denial, and write denial were verified. On 2026-09-30
   a manual export, Atlas pull, checksum verification, and temporary restore passed; both SQLite
   databases passed integrity checks and a restored Git repository passed `git fsck`. Both daily
-  timers are enabled for 02:00/03:00 Europe/Rome; their first scheduled results remain unverified.
+  timers are enabled for 02:00/03:00 Europe/Rome. On 2026-10-01 their first scheduled export and
+  pull succeeded: Atlas verified the payload checksum and published `20261001T000001Z` as `latest`.
 - [x] Decide whether a common SMB/NFS namespace is required: no. `Archive` (SMB) and `photobook` (NFS)
   remain intentionally distinct; `docs/atlas-sharing-decision.md` records the decision. No ACL or export
   change is authorized by this decision.
 
 ### Priority 3 - Service expansion
-- [ ] After data protection and recovery are validated, populate `/zpool/media/music` and validate Navidrome.
+- [x] Populate `/zpool/media/music` and validate Navidrome. On 2026-09-30, 21,158 files
+  (93,937,810,350 regular-file bytes) were copied from `/zpool/archive/Music` using a temporary
+  ZFS snapshot; a checksum-based rsync dry run found no differences or extra files. Navidrome saw
+  all files through its read-only mount, completed a scan, indexed 18,168 tracks, and responded
+  over HTTP. Some imported playlists still reference obsolete Windows paths. The source was left
+  intact and the temporary snapshot was removed.
+- [x] Schedule a daily, non-deleting copy from `Archive/Music` to the separate Navidrome music
+  dataset. The rootless `atlas-music-sync.timer` is enabled for 00:45 Europe/Rome; a manual
+  idempotent service run succeeded on 2026-10-01. The first scheduled run triggered at
+  00:45 CEST on 2026-10-02 and exited successfully (`Result=success`, status 0); the next
+  run is scheduled for 2026-10-03 00:45 CEST.
 - [x] Design the staged Prometheus-to-Atlas Gitea migration in `docs/atlas-gitea-migration.md`.
   The approved topology keeps NPM on Prometheus and moves HTTPS and public SSH (TCP/2222) together;
   Gitea runs as an `admin`-owned rootless user Quadlet on Atlas with an internal `gitea` user.