feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

serverAppConfigs-docs/log.md

@@ -389,3 +389,18 @@ timestamp: 2026-09-14
 - `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it.
 - `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data).
 - `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing.
+
+## 2026-09-04 — Sonarr moved to the admin side; internal-only by construction
+- Operator directive (fixing an earlier seerr/sonarr mix-up): Sonarr is an
+  **admin-side** service and must be locally reachable only. The homepage
+  registry flipped its card from the user category to **admin** and repointed
+  the link at `http://192.168.0.112:8989` (LAN-direct). Users keep requesting
+  TV through Seerr, which stays on the user side behind the guard chain.
+- Exposure closure: the unguarded public vhost `sonarr.franksdank.cloud`
+  (direct `reverse_proxy 192.168.0.112:8989`, no auth) and its post-auth
+  `@sonarr` handler were retired from the Caddyfile; the Pi-hole addn-hosts A
+  record for the name was dropped with it. No public Porkbun record ever
+  existed (NXDOMAIN at the authoritative zone), so after this change there is
+  no WAN path to Sonarr at all — manual DNS could previously reach the vhost,
+  which served the zero-auth UI to anyone who resolved the name manually at
+  the public edge; the vhost (added in `e0bade6`, 2026-09-04) is retired.