frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

frankbook-pro/gluetun/quadlet/gluetun.container

@@ -0,0 +1,43 @@
+# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
+#
+# Install path is INSIDE the machine VM:
+#   /home/core/.config/containers/systemd/gluetun.container
+# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
+# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
+#
+# WireGuard tunnel to ProtonVPN. qBittorrent shares this container's network
+# namespace (Network=gluetun.container) so torrent egress never touches the
+# residential IP. qBittorrent's WebUI and BitTorrent ports publish HERE — a
+# netns-sharer publishes no ports of its own (same invariant as the dankclaw
+# searxng/gluetun pair). Credentials live in
+# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
+# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
+# from dankclaw — one WireGuard peer key cannot serve two machines at once.
+[Unit]
+Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)
+
+[Container]
+ContainerName=gluetun
+Image=docker.io/qmcgaw/gluetun:latest
+AddCapability=NET_ADMIN
+AddDevice=/dev/net/tun:/dev/net/tun
+Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
+Environment=VPN_TYPE=${VPN_TYPE}
+Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
+Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
+Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
+Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
+Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
+Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
+Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
+PublishPort=8080:8080
+PublishPort=6881:6881
+PublishPort=6881:6881/udp
+
+[Service]
+EnvironmentFile=/home/core/Containers/gluetun/env
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target