feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

serverAppConfigs-docs/Dankserver/sonarr.md

@@ -3,7 +3,7 @@ type: reference
 title: Sonarr
 description: Sonarr TV manager in the *arr stack on FrankBook-Pro — live quadlet deployment, ports, volumes, and wiring facts.
 tags: [sonarr, arr-stack, frankbook-pro]
-timestamp: 2026-09-03T00:00:00Z
+timestamp: 2026-09-04T00:00:00Z
 ---
 
 # Sonarr
@@ -13,7 +13,11 @@ Sonarr manages TV shows in the *arr stack. The stack runs on **FrankBook-Pro**
 It searches, downloads, and organizes episodes from indexers into the Jellyfin
 TV library.
 
-**Host:** FrankBook-Pro (podman machine) — **Access:** direct port `8989` (no reverse-proxy vhost; the *arr stack is exempt by construction from the Anubis guard chain) — **Docs:** https://wiki.servarr.com/sonarr
+**Host:** FrankBook-Pro (podman machine) — **Access:** LAN-direct only at
+`http://192.168.0.112:8989` — no vhost and no public DNS record by construction
+(the brief unguarded `sonarr.franksdank.cloud` vhost was retired 2026-09-04;
+users request TV via [[Seerr]], admins use this UI from the LAN) —
+**Docs:** https://wiki.servarr.com/sonarr
 
 ## Facts