docs(arr): record live chain wiring — per-arr qB clients, Prowlarr Applications rows, test-before-enable policy

Verified live: indexers->Prowlarr->per-arr QBittorrent download clients with
category routing. Readarr's client parked (qB proxy auth defect in abandoned
upstream). EZTV/1337x parked with reason (CloudFlare-blocked at this egress);
Nyaa/sukebei/RuTor/Byrutor/YTS passed live tests and are enabled. Prowlarr v2
Applications rows now carry real arr baseUrl+apiKeys; before this every sync
attempt threw NullConfig in GetIndexerMappings.

serverAppConfigs-docs/Dankserver/ARR-Stack.md

@@ -339,6 +339,31 @@ Deployed shape differs from the design compose above — reality wins:
   exposure — first-account-wins is the current race condition.
 - API keys live in each `/config/config.xml` (`<ApiKey>`); they are local-only
   secrets and stop being secret the moment a vhost serves the API unauthenticated.
+### Chain wiring (verified live 2026-08-29)
+
+The download chain is wired and test-first verified: **indexers → Prowlarr →
+per-arr qBittorrent clients (category = app name) → import**.
+
+- qB webUI auth is ON (`admin` + generated password; verify before writing it
+  into any config — it was generated at first boot, not a default).
+- Per-arr QBittorrent download clients exist on sonarr/radarr/lidarr
+  (enabled) and readarr (**parked**: its qB proxy fails auth live even with
+  correct creds — known defect of the abandoned upstream; do not enable until
+  the image changes). Each was **tested before enabling**; failures stay parked
+  with a reason, never enabled blind.
+- Prowlarr runs v2.5.2 where apps are first-class rows (`Applications` table):
+  four Application rows (sonarr/radarr/lidarr/readarr) now carry each arr's
+  real baseUrl+apiKey with `SyncLevel=FullSync`. Before this, the table was
+  empty and every sync attempt threw `NullConfig` in `GetIndexerMappings()` —
+  visible in `podman logs prowlarr`, not in any UI.
+- Indexers are **test-before-enable**: EZTV and 1337x stay disabled with reason
+  "blocked by CloudFlare Protection" (this host's egress ASN is CF-blocked at
+  those trackers); Nyaa.si, sukebei, RuTor, Byrutor, YTS passed live tests and
+  are enabled. A failed test = parked with reason, never enabled blind.
+- Prowlarr v2 sync model: indexers stay in Prowlarr; arrs search *through* it
+  and hand off to their own qB download client (category routing). Mappings
+  materialize at grab time — zero mappings right after wiring is expected,
+  not a fault.
 
 ## Disk Layout