Plan: media-admins group for full copyparty rights in phase 5

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -185,7 +185,9 @@ Checklist:
 - [ ] Caddy: `forward_auth 127.0.0.1:9000 { uri /outpost.goauthentik.io/auth/caddy; copy_headers X-Authentik-Username X-Authentik-Groups … }`
       on `/`, `/dock*`, `/dump*`, `/sync*`; `reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000`
 - [ ] copyparty: `idp-h-usr: X-Authentik-Username`, `idp-h-grp: X-Authentik-Groups`, `xff-src` = Caddy only;
-      volume accs become `r: @editors`, `rw: @editors` (finals), `rwmd: @admins`
+      volume accs become `r: @editors`, `rw: @editors` (finals), `rwmd: @media-admins` on every volume incl. trash
+      (new group `media-admins`; techy joins it via a Discord role in the roles→groups table or a manual add —
+      replaces today's workaround of logging in as the local `admin` account to modify streams/clips)
 - [ ] keep the local accounts in `copyparty.conf` until an `editors` Discord user has browsed and
       downloaded through the new path; then remove them (`configure.py` drops the editors section)
 - [ ] WebDAV: editor creates an app password in Authentik → mounts with Discord username + app password