feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

dankclaw/pihole/addn-hosts

@@ -27,7 +27,6 @@
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
-192.168.0.143 sonarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud
 192.168.0.143 prowlarr.franksdank.cloud