use setup_hwaccel for robust hardware acceleration (#10054)

* fix(jellyfin): use setup_hwaccel for robust hardware acceleration

Replaces manual hardware acceleration setup with the centralized
setup_hwaccel function from tools.func.

This fixes the installation failure in privileged containers where
/dev/dri does not exist (e.g., when no GPU is passed through).

The setup_hwaccel function includes:
- Proper error handling for missing /dev/dri
- GPU vendor detection (Intel, AMD, NVIDIA)
- Graceful fallback when no GPU is available

Fixes: Installation fails with 'chgrp: cannot access /dev/dri'
when creating privileged containers without GPU passthrough.

* refactor(hwaccel): standardize hardware acceleration across all install scripts

Migrated all install scripts to use the centralized setup_hwaccel function:
- plex-install.sh
- emby-install.sh
- ersatztv-install.sh
- frigate-install.sh
- tdarr-install.sh
- unmanic-install.sh
- channels-install.sh
- ollama-install.sh
- immich-install.sh (added error handling)

Enhanced setup_hwaccel function in tools.func:
- Added -d /dev/dri check before setting permissions
- Added error handling (2>/dev/null || true) for all /dev/dri operations
- Added adduser error handling for video/render groups
- No longer fails if no GPU is detected (graceful skip)
- Added intel-media-va-driver for newer Intel GPUs
- Improved AMD APU support with firmware packages
- Better NVIDIA handling (warning instead of failure)

This fixes installation failures in privileged containers without GPU
passthrough, where /dev/dri does not exist.

Supports: Ubuntu, Debian 12 (Bookworm), Debian 13 (Trixie)
GPU Support: Intel, AMD, NVIDIA (manual driver)

* refactor(hwaccel): complete migration for all GPU apps

Migrated remaining GPU apps to setup_hwaccel:
- fileflows-install.sh
- openwebui-install.sh (added setup_hwaccel - was missing)
- tunarr-install.sh

Also fixed tools/pve/hw-acceleration.sh:
- Added error handling for /dev/dri operations
- Added chmod 660 /dev/dri/* that was missing
- Added error suppression for adduser commands

All 13 GPU apps (var_gpu=yes) now use centralized setup_hwaccel:
jellyfin, plex, emby, ersatztv, frigate, tdarr, unmanic,
channels, ollama, immich, fileflows, openwebui, tunarr

* feat(hwaccel): complete Intel non-free driver support and GID sync

Enhanced setup_hwaccel function:
- Auto-detect Intel GPU generation (Gen 9+ for non-free drivers)
- Debian 12 (Bookworm): Add non-free repo + intel-media-va-driver-non-free
- Debian 13 (Trixie): Add non-free repo + libvpl2 + mesa-opencl-icd
- Ubuntu: Use ubuntu repos with intel-media-va-driver
- Fallback to open drivers if non-free fails
- GID sync for video/render groups (moved from install scripts)

OpenWebUI: Added Intel oneAPI support when installing Ollama
- Intel Level Zero GPU support
- Intel oneAPI Base Toolkit
- Same setup as standalone Ollama install

Cleanup:
- Removed duplicate GID sync from tdarr-install.sh
- Removed duplicate GID sync from unmanic-install.sh

* fix(ersatztv): remove duplicate HW acceleration code

Removed manual Intel HW acceleration setup that remained after
setup_hwaccel migration. The non-free driver prompt is no longer
needed as setup_hwaccel auto-detects Intel GPU generation.

install/openwebui-install.sh

@@ -17,6 +17,8 @@ msg_info "Installing Dependencies"
 $STD apt install -y ffmpeg
 msg_ok "Installed Dependencies"
 
+setup_hwaccel
+
 PYTHON_VERSION="3.12" setup_uv
 
 msg_info "Installing Open WebUI"
@@ -25,6 +27,36 @@ msg_ok "Installed Open WebUI"
 
 read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+  msg_info "Setting up Intel® Repositories"
+  mkdir -p /usr/share/keyrings
+  curl -fsSL https://repositories.intel.com/gpu/intel-graphics.key | gpg --dearmor -o /usr/share/keyrings/intel-graphics.gpg 2>/dev/null || true
+  cat <<EOF >/etc/apt/sources.list.d/intel-gpu.sources
+Types: deb
+URIs: https://repositories.intel.com/gpu/ubuntu
+Suites: jammy
+Components: client
+Architectures: amd64 i386
+Signed-By: /usr/share/keyrings/intel-graphics.gpg
+EOF
+  curl -fsSL https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | gpg --dearmor -o /usr/share/keyrings/oneapi-archive-keyring.gpg 2>/dev/null || true
+  cat <<EOF >/etc/apt/sources.list.d/oneAPI.sources
+Types: deb
+URIs: https://apt.repos.intel.com/oneapi
+Suites: all
+Components: main
+Signed-By: /usr/share/keyrings/oneapi-archive-keyring.gpg
+EOF
+  $STD apt update
+  msg_ok "Set up Intel® Repositories"
+
+  msg_info "Installing Intel® Level Zero"
+  $STD apt -y install intel-level-zero-gpu level-zero level-zero-dev 2>/dev/null || true
+  msg_ok "Installed Intel® Level Zero"
+
+  msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
+  $STD apt install -y --no-install-recommends intel-basekit-2024.1 2>/dev/null || true
+  msg_ok "Installed Intel® oneAPI Base Toolkit"
+
   msg_info "Installing Ollama"
   curl -fsSLO -C - https://ollama.com/download/ollama-linux-amd64.tgz
   tar -C /usr -xzf ollama-linux-amd64.tgz