docs(arr): chain complete 4/4 + auth-config pitfall (v1 DryIoc 500 sprawl)

All four arr roots live: /tv, /movies via API; /music, /books created after
v1 validator layers peeled back (quality/metadata profile ids must reference
existing profiles; v1 has no /api/v1/profile endpoint). Auth pitfall: the
literal AuthenticationRequired=Disabled string throws DryIoc.ScopedItemException
in v1 AuthorizationMiddleware on every request — the valid no-auth state is
ABSENCE of the key. Fixed live on four containers, verified boot clean.

serverAppConfigs-docs/Dankserver/ARR-Stack.md

@@ -364,16 +364,28 @@ per-arr qBittorrent clients (category = app name) → import**.
   and hand off to their own qB download client (category routing). Mappings
   materialize at grab time — zero mappings right after wiring is expected,
   not a fault.
-**Chain completion (same day):** Sonarr and Radarr root folders created via
-API (`/tv`, `/movies` → 201). Lidarr/Readarr roots deferred to their first-run
-wizard (v1 API validators demand quality-profile ids that don't exist yet — two
-clicks in the UI, not an API guess). The blocker under all of it: LSIO images
-run as `PUID=1000`, which under rootless podman's userns maps to host uid
-**101000 — a phantom user owning nothing**; Sonarr's own validator refused
-`/tv` with "not writable by user 'abc'" (placeholder name for the unknown
-uid). Fix: `PUID=0/PGID=0` on the arr stack + qbittorrent + prowlarr
-(container-root = host's `dank`, which owns every media dir; mapping-
-independent by construction). calibre-web and jellyfin untouched — not broken.
+**Chain complete (same day):** all four arr roots live — Sonarr `/tv`,
+Radarr `/movies` (201), and Lidarr `/music` + Readarr `/books` created via
+API after the v1 validator layers peeled back one at a time
+(`defaultQualityProfileId`/`defaultMetadataProfileId` must reference an
+*existing* profile id on v1 apps; v1 has no `/api/v1/profile` endpoint —
+probe endpoints by status code, empty body = absent).
+
+**Auth-config pitfall (found same day):** all five arrs shipped with
+`AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the
+v1 (.NET) apps that combo is self-contradictory — UI Save is permanently
+disabled and any settings save throws
+`DryIoc.ScopedItemException` inside `AuthorizationMiddleware` (500 sprawl on
+every page after restart). The valid representation of "no auth" in v1 is
+**absence of the `<AuthenticationRequired>` key**, not the literal string
+`Disabled` — readarr's config (key absent) booted clean while its three
+siblings (key=`Disabled`) 500-sprawled, which is how it was caught. Fix
+applied live: key deleted on sonarr/radarr/lidarr/prowlarr, containers
+restarted, all five verified serving. Posture = zero-auth arrs on LAN and
+WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files
+but **not** the arrs — if WAN exposure of `/sonarr`, `/radarr` etc. is
+undesired, guard them in the Anubis policy or flip auth to `External`
+(needs an IdP first; auth method choice remains an operator decision).
 
 ## Disk Layout