Native Dagger container builds + Navidrome v0.61.1 (#330)

## Summary
- Move Dagger module from `.dagger/` to repo root (`src/blumeops/`), rename `blumeops-ci` → `blumeops`
- Replace opaque `docker_build()` with native Dagger pipelines that surface full build errors per step
- Migrate navidrome as the first container (`containers/navidrome/container.py`)
- Upgrade navidrome from v0.60.3 to v0.61.1 (major artwork overhaul, SQLite FTS5 search, server-managed transcoding)
- Add `dagger call container-version` for CI version extraction without Dockerfile parsing
- All mise tasks (`container-list`, `container-version-check`, `container-build-and-release`) updated for hybrid mode
- Legacy `docker_build()` fallback preserved for all other containers

## Motivation
When navidrome v0.61.0 added a new Go build tag (`sqlite_fts5`), `docker_build()` showed only "exit code: 1". We had to run `docker build --progress=plain` manually to find `undefined: buildtags.SQLITE_FTS5`. Native Dagger pipelines show the full error inline.

## Container build dispatch needed
After merge, dispatch container build for navidrome:
```
mise run container-build-and-release navidrome --ref 470b4bd
```

## Deploy steps
1. Wait for container build to complete
2. Back up navidrome-data PVC (non-reversible DB migrations)
3. `argocd app set navidrome --revision main && argocd app sync navidrome`
4. Verify at https://dj.ops.eblu.me

## Future
Remaining containers migrate incrementally in follow-up PRs using the same pattern.

Reviewed-on: #330

docs/how-to/zot/add-container-version-sync-check.md

@@ -1,6 +1,6 @@
 ---
 title: Add Container Version Sync Check
-modified: 2026-02-20
+modified: 2026-04-11
 tags:
   - how-to
   - containers
@@ -10,7 +10,7 @@ tags:
 
 # Add Container Version Sync Check
 
-Add a prek check that validates version consistency across the three places container versions are declared: Dockerfile ARGs, `service-versions.yaml`, and nix derivations. No VERSION files needed — the existing sources are the source of truth, and the check enforces they agree.
+Add a prek check that validates version consistency across the places container versions are declared: `container.py` VERSION constants, Dockerfile ARGs, `service-versions.yaml`, and nix derivations. The check enforces they agree.
 
 ## Context
 
@@ -20,13 +20,14 @@ Discovered during analysis of [[adopt-commit-based-container-tags]]: the new com
 
 ### 1. Created `mise run container-version-check` task
 
-A typer-based uv-script that iterates over `containers/*/` and validates five rules per container:
+A typer-based uv-script that iterates over `containers/*/` and validates six rules per container:
 
-1. Any Dockerfile must declare `ARG CONTAINER_APP_VERSION=<value>`
-2. Any `default.nix` must produce a version via `dagger call nix-version`
-3. At least one build file must exist (Dockerfile or default.nix)
-4. A matching `service-versions.yaml` entry must exist with non-null `current-version`
-5. All resolved versions from (1), (2), and (4) must agree (v-prefix stripped for comparison)
+1. Any `container.py` must declare `VERSION = "<value>"`
+2. Any Dockerfile must declare `ARG CONTAINER_APP_VERSION=<value>`
+3. Any `default.nix` must produce a version via `dagger call nix-version`
+4. At least one build file must exist (`container.py`, Dockerfile, or `default.nix`)
+5. A matching `service-versions.yaml` entry must exist with non-null `current-version`
+6. All resolved versions from (1), (2), (3), and (5) must agree (v-prefix stripped for comparison)
 
 Scoping: by default only checks containers changed vs main. `--all-files` checks everything. If `service-versions.yaml` itself changed, all containers are checked.