Add arr stack vhosts to Caddyfile — public blocks + :8017 named handlers

The arr stack (prowlarr, radarr, sonarr, lidarr, readarr, qbittorrent)
had A records in addn-hosts but no Caddyfile blocks. This adds:

- Six public vhost blocks in the dankserver section, each proxying to
  192.168.0.235:<port> (exempt by construction: own auth, no Anubis)
- Six @arr named handlers inside :8017 for authenticated traffic routing

All 233 bats tests pass.

dankclaw/Caddyfile

@@ -237,6 +237,33 @@ jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
 }
 
+
+# --- *arr Stack (exempt by construction: own auth) ---
+
+prowlarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:9696
+}
+
+radarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:7878
+}
+
+sonarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8989
+}
+
+lidarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8686
+}
+
+readarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8787
+}
+
+qbittorrent.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8080
+}
+
 # --- Internal listener: auth decision layer ---------------------------------
 # Anubis dials http://caddy:8016 after verifying a client (TARGET in
 # dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop.
@@ -324,6 +351,36 @@ http://:8017 {
 	handle @files {
 		reverse_proxy 192.168.0.235:3923
 	}
+
+	@prowlarr host prowlarr.franksdank.cloud
+	handle @prowlarr {
+		reverse_proxy 192.168.0.235:9696
+	}
+
+	@radarr host radarr.franksdank.cloud
+	handle @radarr {
+		reverse_proxy 192.168.0.235:7878
+	}
+
+	@sonarr host sonarr.franksdank.cloud
+	handle @sonarr {
+		reverse_proxy 192.168.0.235:8989
+	}
+
+	@lidarr host lidarr.franksdank.cloud
+	handle @lidarr {
+		reverse_proxy 192.168.0.235:8686
+	}
+
+	@readarr host readarr.franksdank.cloud
+	handle @readarr {
+		reverse_proxy 192.168.0.235:8787
+	}
+
+	@qbittorrent host qbittorrent.franksdank.cloud
+	handle @qbittorrent {
+		reverse_proxy 192.168.0.235:8080
+	}
 }
 
 # --- Optional: Jackett ---