frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

frankbook-pro/prowlarr/quadlet/prowlarr.container

@@ -0,0 +1,33 @@
+# Quadlet unit: Prowlarr in FrankBook-Pro's podman machine.
+#
+# Install path is INSIDE the machine VM:
+#   /home/core/.config/containers/systemd/prowlarr.container
+#
+# Arr on the Mac is grab-only: indexer + app-sync management lives here, the
+# arrs never auto-import media (the user reviews completed torrents in
+# /Volumes/COMPLETE/"Finished Torrents" and moves files manually into the
+# library, which lives on dankserver's entropy disk).
+#
+# Config is migrated from dankserver's retired bare container
+# (tar-archived first, per the Phase 4 cutover note) — indexers and app
+# settings survive; stale host pointers (old qbit at 192.168.0.235:8080)
+# are re-pointed to the Mac's qbit via its API after first boot.
+[Unit]
+Description=Prowlarr (FrankBook-Pro)
+
+[Container]
+ContainerName=prowlarr
+Image=lscr.io/linuxserver/prowlarr:latest
+Environment=PUID=0
+Environment=PGID=0
+Environment=TZ=America/Los_Angeles
+Environment=UMASK_SET=022
+Volume=/Volumes/COMPLETE/prowlarr-data:/config
+PublishPort=9696:9696
+
+[Service]
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target