feat(glyph): enable music-assistant

[stackptr]

Summary

• Enables services.music-assistant on glyph with opensubsonic (Navidrome), airplay, musicbrainz, and coverartarchive providers
• Moves grafana-mcp from port 8095 → 8096 and obsidian-vault-mcp from port 8097 → 8098 to free those ports for Music Assistant's defaults
• Updates MCPJungle aggregator URLs to match the new MCP ports

Why the MCP ports moved

Music Assistant's web UI defaults to 8095 and its audio stream port to 8097 (derived as web_port + 2). Both of these collided with existing localhost MCP services:

• grafana-mcp was on 8095
• obsidian-vault-mcp was on 8097

The nixpkgs services.music-assistant module has no port option — the only escape hatch is passing --port via extraOptions. However, the module's openFirewall implementation hardcodes 8097 unconditionally regardless of what --port is passed, so changing MA's port would mean openFirewall = true opens the wrong port and misses the actual stream port. That would require openFirewall = false plus manual firewall rules, adding complexity for no real benefit.

Moving the two MCP services by one port each (8095→8096, 8097→8098) is the cleaner fix: MA runs on its standard ports, openFirewall = true works correctly, and the MCP services remain localhost-only so nothing external is affected.

Test plan

• Deploy to glyph: nh os switch .#glyph
• Music Assistant web UI reachable at http://glyph:8095
• Configure Navidrome as an OpenSubsonic source in the MA UI (URL: http://localhost:4533)
• Verify grafana-mcp still reachable by MCPJungle: curl http://localhost:8096/mcp
• Verify obsidian-vault-mcp still reachable: curl http://localhost:8098/mcp
• Verify Open WebUI MCP tools still work end-to-end

🤖 Generated with Claude Code