frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

tests/deployment_scoping.bats

@@ -111,6 +111,17 @@ REMOTE_DEPLOY="$REPO_ROOT/scripts/deploy-remote.sh"
     [ "$output" = $'gitea-postgres\ngitea-server' ]
 }
 
+@test "frankbook-pro gluetun changes carry qbittorrent; arr changes stay scoped" {
+    run python3 "$PLANNER" --target frankbook-pro --paths \
+        frankbook-pro/gluetun/quadlet/gluetun.container
+    [ "$status" -eq 0 ]
+    [ "$output" = $'gluetun\nqbittorrent' ]
+    run python3 "$PLANNER" --target frankbook-pro --paths \
+        frankbook-pro/sonarr/quadlet/sonarr.container
+    [ "$status" -eq 0 ]
+    [ "$output" = "sonarr" ]
+}
+
 @test "remote Caddy deployment no longer blocks on the retired Gitea proxy" {
     ! grep -q 'refusing to replace it with caddy' "$REMOTE_DEPLOY"
     ! grep -q 'podman container exists gitea-caddy &&' "$REMOTE_DEPLOY"