frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

frankbook-pro/qbittorrent/quadlet/qbittorrent.container

@@ -0,0 +1,43 @@
+# Quadlet unit: qBittorrent in FrankBook-Pro's podman machine.
+#
+# Install path is INSIDE the machine VM:
+#   /home/core/.config/containers/systemd/qbittorrent.container
+#
+# Joins gluetun's network namespace (Network=gluetun.container) so all
+# BitTorrent egress exits the WireGuard tunnel. It publishes NO port of its
+# own — WebUI 8080 and torrent port 6881 publish on the gluetun unit.
+#
+# Data layout (plan-locked, verbatim paths):
+#   /config  <- /Volumes/COMPLETE/qbittorrent-data   (durable config)
+#   /Volumes/COMPLETE + /Volumes/INCOMPLETE same-path virtiofs passthroughs —
+#   the seeded qBittorrent.conf references those literal paths:
+#     Session\DefaultSavePath=/Volumes/COMPLETE
+#     Session\TempPath=/Volumes/INCOMPLETE/incomplete  (in-progress disk)
+#   category "Finished Torrents" -> /Volumes/COMPLETE/Finished Torrents
+#   (the human review dir; nothing automated ever writes to entropy).
+#
+# WebUI password: generated fresh at provisioning by the deploy handler,
+# stored machine-local only (conf + /home/core/Containers/qbittorrent/env).
+[Unit]
+Description=qBittorrent behind gluetun (FrankBook-Pro)
+Wants=gluetun.service
+After=gluetun.service
+
+[Container]
+ContainerName=qbittorrent
+Network=gluetun.container
+Image=lscr.io/linuxserver/qbittorrent:latest
+Environment=PUID=0
+Environment=PGID=0
+Environment=TZ=America/Los_Angeles
+Environment=UMASK_SET=022
+Volume=/Volumes/COMPLETE/qbittorrent-data:/config
+Volume=/Volumes/COMPLETE:/Volumes/COMPLETE
+Volume=/Volumes/INCOMPLETE:/Volumes/INCOMPLETE
+
+[Service]
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target