feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

dankclaw/Caddyfile

@@ -248,9 +248,12 @@ radarr.franksdank.cloud {
 	reverse_proxy 192.168.0.112:7878
 }
 
-sonarr.franksdank.cloud {
-	reverse_proxy 192.168.0.112:8989
-}
+# --- Sonarr: internal-only by construction (retired 2026-09-04) -----------
+# No vhost and no public DNS record for sonarr.franksdank.cloud: the TV-library
+# admin UI is reachable only on the LAN at 192.168.0.112:8989 (users request TV
+# through Seerr, which sits behind the guard chain; admins reach Sonarr's own
+# UI directly). A brief unguarded public vhost lived here and served the
+# zero-auth UI to the internet via manual DNS — retired.
 
 lidarr.franksdank.cloud {
 	reverse_proxy 192.168.0.112:8686
@@ -362,11 +365,6 @@ http://:8017 {
 		reverse_proxy 192.168.0.112:7878
 	}
 
-	@sonarr host sonarr.franksdank.cloud
-	handle @sonarr {
-		reverse_proxy 192.168.0.112:8989
-	}
-
 	@lidarr host lidarr.franksdank.cloud
 	handle @lidarr {
 		reverse_proxy 192.168.0.112:8686