Interesting takes. I see and understand your points now.

But regarding your CG-NAT situation:
Sorry but no. This is so much out of scope for the Jellyfin team.
This is something you need to solve by yourself.
Jellyfin can make it easy to maybe offer an integration but beyond that it’s IMO not within the general scope.

Sonarr/Radarr? Yes.

Sent to the wrong comment lol. Disregard the previous one. Anyway: Sonarr/Radarr doesnt do any downloading. They just manage the sending of the task to the downloader and the import.

• default SSL

Reverse proxy or configuration in the admin settings

• Carrier grade nat relay.

Not the point of an open source server. That’s your issue.

• caching the TVDB and movie DB.

Why?? But anyway, Jellyfin can poll those for metadata

• Centralized login and account management with 2FA

There is a plugin to do OpenID

• fast search on large libraries.

Can’t comment on that. My library is small (<10TB)

What you want to it withvis called sonarr/radarr

Either you misconfigured something or you are very new to this.
Keep it up.

As for good guides: Trash-guides
They provide a very in depth set-up that works really well.

The only thing you’ll need after this, is a source for the files.

This is a requesting client.

What you want is solved by torrenting (and other) clients.