feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

shared/homepage/services.json

@@ -100,9 +100,9 @@
   },
   {
     "name": "Sonarr",
-    "category": "user",
+    "category": "admin",
     "description": "TV series library and automation.",
-    "url": "http://sonarr.franksdank.cloud",
+    "url": "http://192.168.0.112:8989",
     "docs": "",
     "probe": "192.168.0.112:8989",
     "method": "http",