arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated

FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet
container (qB + five arrs) now shares gluetun's netns, so all egress —
torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by
construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the
gluetun unit, none on the arr units themselves.

- dankserver/compose.yaml: remove the six arr services (the Aug 20 compose
  copy — never healthy, superseded; config dirs trashed on the host)
- dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and
  probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro)
- frankbook-pro units: five arrs join gluetun netns (Wants/After/Network);
  gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881
- tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit
  must share gluetun's netns and publish no port; gluetun must publish the
  whole fleet's ports
- deploy-plan.py: gluetun changes carry the whole netns family (a gluetun
  recreation kills all six joiners); dankserver compose set loses the arrs
- AGENTS.md: deployment is complete only when unit tests AND the Playwright
  E2E suite both pass

scripts/deploy-plan.py

@@ -147,12 +147,6 @@ DANKSERVER_COMPOSE_SERVICES = {
     "copyparty",
     "jellyfin",
     "calibre-web",
-    "prowlarr",
-    "qbittorrent",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
 }
 COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
 
@@ -341,9 +335,11 @@ def services_for_path(path: str, target: str) -> set[str]:
         if len(parts) >= 3 and parts[2] == "quadlet":
             name = parts[3].removesuffix(".container")
             if name == "gluetun":
-                # qBittorrent shares gluetun's network namespace; a gluetun
-                # recreation requires both units to be restarted.
-                _add(services, "gluetun", "qbittorrent")
+                # Every *arr + qBittorrent container shares gluetun's
+                # network namespace; a gluetun recreation kills all of
+                # them, so the plan restarts the whole netns family.
+                _add(services, "gluetun", "qbittorrent",
+                     "prowlarr", "sonarr", "radarr", "lidarr", "readarr")
             elif name in FRANKBOOK_SERVICES:
                 _add(services, name)
         return services