frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

frankbook-pro/lidarr/quadlet/lidarr.container

@@ -0,0 +1,26 @@
+# Quadlet unit: Lidarr in FrankBook-Pro's podman machine.
+#
+# Install path is INSIDE the machine VM:
+#   /home/core/.config/containers/systemd/lidarr.container
+#
+# Grab-only: no media binds; config migrated from dankserver's retired
+# bare container.
+[Unit]
+Description=Lidarr (FrankBook-Pro)
+
+[Container]
+ContainerName=lidarr
+Image=lscr.io/linuxserver/lidarr:latest
+Environment=PUID=0
+Environment=PGID=0
+Environment=TZ=America/Los_Angeles
+Environment=UMASK_SET=022
+Volume=/Volumes/COMPLETE/lidarr-data:/config
+PublishPort=8686:8686
+
+[Service]
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target