Native Dagger container builds + Navidrome v0.61.1 (#330)

## Summary
- Move Dagger module from `.dagger/` to repo root (`src/blumeops/`), rename `blumeops-ci` → `blumeops`
- Replace opaque `docker_build()` with native Dagger pipelines that surface full build errors per step
- Migrate navidrome as the first container (`containers/navidrome/container.py`)
- Upgrade navidrome from v0.60.3 to v0.61.1 (major artwork overhaul, SQLite FTS5 search, server-managed transcoding)
- Add `dagger call container-version` for CI version extraction without Dockerfile parsing
- All mise tasks (`container-list`, `container-version-check`, `container-build-and-release`) updated for hybrid mode
- Legacy `docker_build()` fallback preserved for all other containers

## Motivation
When navidrome v0.61.0 added a new Go build tag (`sqlite_fts5`), `docker_build()` showed only "exit code: 1". We had to run `docker build --progress=plain` manually to find `undefined: buildtags.SQLITE_FTS5`. Native Dagger pipelines show the full error inline.

## Container build dispatch needed
After merge, dispatch container build for navidrome:
```
mise run container-build-and-release navidrome --ref 470b4bd
```

## Deploy steps
1. Wait for container build to complete
2. Back up navidrome-data PVC (non-reversible DB migrations)
3. `argocd app set navidrome --revision main && argocd app sync navidrome`
4. Verify at https://dj.ops.eblu.me

## Future
Remaining containers migrate incrementally in follow-up PRs using the same pattern.

Reviewed-on: #330

docs/how-to/zot/wire-ci-registry-auth.md

@@ -1,6 +1,6 @@
 ---
 title: Wire CI Registry Auth
-modified: 2026-02-21
+modified: 2026-04-11
 tags:
   - how-to
   - zot
@@ -36,7 +36,7 @@ Authentication uses a zot API key generated after the service account's first OI
 
 | File | Purpose |
 |------|---------|
-| `.dagger/src/blumeops_ci/main.py` | `publish()` accepts optional `registry_password` |
+| `src/blumeops/main.py` | `publish()` accepts optional `registry_password` |
 | `.forgejo/workflows/build-container.yaml` | Passes API key to Dagger |
 | `.forgejo/workflows/build-container-nix.yaml` | Passes API key to skopeo |
 | `ansible/playbooks/indri.yml` | Pre_task fetches API key from 1Password |