arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated

FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet
container (qB + five arrs) now shares gluetun's netns, so all egress —
torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by
construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the
gluetun unit, none on the arr units themselves.

- dankserver/compose.yaml: remove the six arr services (the Aug 20 compose
  copy — never healthy, superseded; config dirs trashed on the host)
- dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and
  probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro)
- frankbook-pro units: five arrs join gluetun netns (Wants/After/Network);
  gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881
- tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit
  must share gluetun's netns and publish no port; gluetun must publish the
  whole fleet's ports
- deploy-plan.py: gluetun changes carry the whole netns family (a gluetun
  recreation kills all six joiners); dankserver compose set loses the arrs
- AGENTS.md: deployment is complete only when unit tests AND the Playwright
  E2E suite both pass

dankclaw/Caddyfile

@@ -241,27 +241,27 @@ jelly.franksdank.cloud {
 # --- *arr Stack (exempt by construction: own auth) ---
 
 prowlarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:9696
+	reverse_proxy 192.168.0.112:9696
 }
 
 radarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:7878
+	reverse_proxy 192.168.0.112:7878
 }
 
 sonarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8989
+	reverse_proxy 192.168.0.112:8989
 }
 
 lidarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8686
+	reverse_proxy 192.168.0.112:8686
 }
 
 readarr.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8787
+	reverse_proxy 192.168.0.112:8787
 }
 
 qbittorrent.franksdank.cloud {
-	reverse_proxy 192.168.0.235:8080
+	reverse_proxy 192.168.0.112:8080
 }
 
 # --- Internal listener: auth decision layer ---------------------------------
@@ -354,32 +354,32 @@ http://:8017 {
 
 	@prowlarr host prowlarr.franksdank.cloud
 	handle @prowlarr {
-		reverse_proxy 192.168.0.235:9696
+		reverse_proxy 192.168.0.112:9696
 	}
 
 	@radarr host radarr.franksdank.cloud
 	handle @radarr {
-		reverse_proxy 192.168.0.235:7878
+		reverse_proxy 192.168.0.112:7878
 	}
 
 	@sonarr host sonarr.franksdank.cloud
 	handle @sonarr {
-		reverse_proxy 192.168.0.235:8989
+		reverse_proxy 192.168.0.112:8989
 	}
 
 	@lidarr host lidarr.franksdank.cloud
 	handle @lidarr {
-		reverse_proxy 192.168.0.235:8686
+		reverse_proxy 192.168.0.112:8686
 	}
 
 	@readarr host readarr.franksdank.cloud
 	handle @readarr {
-		reverse_proxy 192.168.0.235:8787
+		reverse_proxy 192.168.0.112:8787
 	}
 
 	@qbittorrent host qbittorrent.franksdank.cloud
 	handle @qbittorrent {
-		reverse_proxy 192.168.0.235:8080
+		reverse_proxy 192.168.0.112:8080
 	}
 }