Harden deployment, authentication, firewall and media storage failure paths

hosts/FredOS-Mediaserver.nix

@@ -186,13 +186,8 @@
     # unsigned store paths sent by the build client).
     nix.settings.trusted-users = [ "root" "fred" ];
 
-    # Automatic daily system updates
-    system.autoUpgrade = {
-      enable = true;
-      flake = "git+https://forg.gregersen.it/rope/nixos";
-      dates = "05:15";
-      allowReboot = true;
-    };
+    # services/deployment.nix owns the 05:15 update and conditional reboot,
+    # using the same health-checked transaction as manual and router UI applies.
 
     # WAN exposure is controlled by nftables in services/router.nix +
     # ports.toml (networking.firewall is disabled on this host).

hosts/hardware/FredOS-Mediaserver.nix

@@ -28,24 +28,31 @@
   fileSystems."/mnt/disk1" = {
     device = "/dev/disk/by-uuid/90ae3493-38c1-4473-b409-e9d99c3b315e";
     fsType = "ext4";
+    options = [ "nofail" "x-systemd.device-timeout=15s" ];
   };
 
   fileSystems."/mnt/disk2" = {
     device = "/dev/disk/by-uuid/58cecfd5-2fd7-4c4b-b3a1-0bf5e9d0beab";
     fsType = "ext4";
+    options = [ "nofail" "x-systemd.device-timeout=15s" ];
   };
 
   fileSystems."/mnt/disk3" = {
     device = "/dev/disk/by-uuid/317660ef-bd75-4fa4-bd20-f96a3926bf7b";
     fsType = "ext4";
+    options = [ "nofail" "x-systemd.device-timeout=15s" ];
   };
 
   # Combined MergerFS pool
   fileSystems."/mnt/storage" = {
     device = "/mnt/disk1:/mnt/disk2:/mnt/disk3";
     fsType = "fuse.mergerfs";
+    # The router may boot without media, but the pool must never start on
+    # bare branch directories or present a silently incomplete library.
+    depends = [ "/mnt/disk1" "/mnt/disk2" "/mnt/disk3" ];
     options = [
       "defaults"
+      "nofail"
       "allow_other"
       "use_ino"
       "cache.files=partial"