arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated

FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet
container (qB + five arrs) now shares gluetun's netns, so all egress —
torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by
construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the
gluetun unit, none on the arr units themselves.

- dankserver/compose.yaml: remove the six arr services (the Aug 20 compose
  copy — never healthy, superseded; config dirs trashed on the host)
- dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and
  probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro)
- frankbook-pro units: five arrs join gluetun netns (Wants/After/Network);
  gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881
- tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit
  must share gluetun's netns and publish no port; gluetun must publish the
  whole fleet's ports
- deploy-plan.py: gluetun changes carry the whole netns family (a gluetun
  recreation kills all six joiners); dankserver compose set loses the arrs
- AGENTS.md: deployment is complete only when unit tests AND the Playwright
  E2E suite both pass

frankbook-pro/gluetun/quadlet/gluetun.container

@@ -5,11 +5,12 @@
 # (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
 # install_quadlet targets the Linux hosts' systemctl --user, not the VM).
 #
-# WireGuard tunnel to ProtonVPN. qBittorrent shares this container's network
-# namespace (Network=gluetun.container) so torrent egress never touches the
-# residential IP. qBittorrent's WebUI and BitTorrent ports publish HERE — a
-# netns-sharer publishes no ports of its own (same invariant as the dankclaw
-# searxng/gluetun pair). Credentials live in
+# WireGuard tunnel to ProtonVPN. qBittorrent and all five *arrs share this
+# container's network namespace (Network=gluetun.container) so every fleet
+# container's egress — torrent traffic, indexer APIs, metadata lookups —
+# exits ONLY through the tunnel (AllowedIPs=0.0.0.0/0). Every fleet port
+# publishes HERE; a netns-sharer publishes no ports of its own (same
+# invariant as the dankclaw searxng/gluetun pair). Credentials live in
 # /home/core/Containers/gluetun/env inside the VM (mode 0600, never
 # committed); the private key is Mac-tunnel-specific and MUST NOT be copied
 # from dankclaw — one WireGuard peer key cannot serve two machines at once.
@@ -33,6 +34,11 @@ Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPA
 PublishPort=8080:8080
 PublishPort=6881:6881
 PublishPort=6881:6881/udp
+PublishPort=9696:9696
+PublishPort=8989:8989
+PublishPort=7878:7878
+PublishPort=8686:8686
+PublishPort=8787:8787
 
 [Service]
 EnvironmentFile=/home/core/Containers/gluetun/env