Fix mpv never starting: drop the PAMName=login hang, tear down old Kodi

The mpv service inherited Kodi's VT-grabbing block (PAMName=login +
StandardInput=tty + TTYPath=/dev/tty1). Opening a "login" PAM session on
tty1 hangs in systemd's pre-exec setup, so mpv was never exec'd at all --
the service sat "running" as systemd-executor with an empty (mpv) cmdline,
no IPC socket, no output.

Two fixes:

1. Simplify the unit. mpv doesn't need a login session or the tty: as the
   sole DRM client on the seat it becomes DRM master implicitly on first
   open, so plain video+render+audio group membership is enough. Removing
   the PAM/tty block lets mpv actually start, initialize the vc4 KMS
   display, and play (verified end-to-end: play/status/next through the
   Flask API, position advancing on screen).

2. install.sh now tears down any leftover Kodi before starting mpv. The
   real trigger this time was an in-place migration: replacing the unit
   files doesn't stop an already-running Kodi, which kept DRM master and
   the tty1 seat and blocked mpv from ever getting the display.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

install.sh

@@ -186,6 +186,20 @@ deploy_current() {
   install_units
   sudo systemctl enable mediapi-mpv mediapi-app >/dev/null 2>&1 || true
 
+  # Migration cleanup: earlier versions ran Kodi as the player. A still-running
+  # Kodi keeps the GPU's DRM master and the tty1 seat, which stops mpv from ever
+  # acquiring the display -- and removing a unit file does NOT stop an already
+  # running process. So explicitly tear any Kodi down before starting mpv.
+  if [[ -e /etc/systemd/system/mediapi-kodi.service ]] || pgrep -x kodi.bin >/dev/null 2>&1; then
+    echo "==> Removing leftover Kodi player ..."
+    sudo systemctl unmask mediapi-kodi.service 2>/dev/null || true
+    sudo systemctl disable --now mediapi-kodi.service 2>/dev/null || true
+    sudo rm -f /etc/systemd/system/mediapi-kodi.service
+    sudo pkill -9 -x kodi.bin 2>/dev/null || true
+    sudo pkill -9 -f kodi-standalone 2>/dev/null || true
+    sudo systemctl daemon-reload
+  fi
+
   echo "==> Starting services ..."
   sudo systemctl restart mediapi-mpv
   sudo systemctl restart mediapi-app

systemd/mediapi-mpv.service.template

@@ -1,26 +1,27 @@
 [Unit]
 Description=mpv video player (KMS/DRM -- the actual player)
-# Needs the DRM/HDMI + sound devices present; takes over the console VT.
+# Needs the DRM/HDMI + sound devices present.
 After=local-fs.target systemd-udev-settle.service sound.target
 Wants=systemd-udev-settle.service
+# Keep a login getty off the primary display so nothing else claims tty1.
 Conflicts=getty@tty1.service
 
 [Service]
 User=${MEDIAPI_USER}
-# mpv on DRM/KMS needs: video+render (GPU/DRM), input (remotes/keyboard), audio
-# (HDMI/ALSA), tty (own the VT). PAMName=login gives it a real logind session so
-# it can take the seat's DRM/input devices.
-SupplementaryGroups=video render input audio tty
-PAMName=login
-TTYPath=/dev/tty1
-StandardInput=tty
-StandardOutput=journal
-StandardError=journal
+# mpv on KMS/DRM needs: video+render (GPU/DRM), input (remotes/keyboard), audio
+# (HDMI/ALSA). It becomes DRM master simply as the first/only DRM client on the
+# seat -- no PAM login session and no elevated capabilities required, provided
+# nothing else is already holding the GPU. (An older Kodi-based deploy DID hold
+# it; install.sh tears any leftover Kodi down before starting this.)
+SupplementaryGroups=video render input audio
 # Create /run/mediapi (owned by this user) for the IPC socket the app connects to.
 RuntimeDirectory=mediapi
-# --idle keeps mpv running with no file loaded (holds the playlist between
-# clips and after the last one), so the service stays up and the app can always
-# reach the socket. Playback is hardware-decoded straight on KMS.
+StandardInput=null
+StandardOutput=journal
+StandardError=journal
+# --idle keeps mpv running with no file loaded (holds the playlist between clips
+# and after the last one), so the service stays up and the app can always reach
+# the socket. Playback renders straight on KMS.
 ExecStart=/usr/bin/mpv \
   --idle=yes \
   --input-ipc-server=/run/mediapi/mpv.sock \