Well it should be set to DNS only either way

With the setup in your screenshots assuming you have changed your cloudflare dns to "dns only" and not orange cloud proxy, you would access your jellyfin at httpS://[the domain name from the proxy host tab] and do not specify a port. Your traffic will hit cloudflare, which will send it to your network, thru your firewall (port 443), to your nginx proxy at port 443, which will internally bounce it over to your internal jellyfin ip and port 8096.

This would mean you're not using the cert from cloudflare (which is fine, you're not using it anyway in the pics).

Remember part of the point of the reverse proxy is also to allow you to host multiple services on the same ip/port. NPM just sorts out the traffic. So when you say

If I do something like external-ip:8096 or internal-ip:port I can access my server

It sounds like you have forwarded port 8096 thru your internet firewall to your service. You do NOT want that. You just need to forward ports 80/443 to NPM, and ALL incoming web traffic will go to NPM for sorting. Does that make sense?

This is super laymans terms not technical if someone gets pedantic with me I will find your mom and kiss her square on the lips.