docs(arr): record live auth posture — zero-user login gate, first-account-wins

Verified live: AuthenticationMethod=None + AuthenticationRequired=Enabled on
all five arrs; unauthenticated API probes return 401 both locally and through
the vhosts. Also records the as-built divergences (entropy mounts, LA timezone,
readarr tag pin, prowlarr mount fix) that supersede the design compose.

serverAppConfigs-docs/Dankserver/ARR-Stack.md

@@ -320,6 +320,25 @@ Profile: Music - Standard
 | Resource usage | Minimal | Moderate |
 
 Use Copyparty for curated file collections. Use *arr for automatic downloads. Use both together for maximum functionality — point *arr download directories at Copyparty's watched folders.
+## Live State (as-built, verified 2026-08-29)
+
+Deployed shape differs from the design compose above — reality wins:
+
+- Mounts are the real array paths (`/mnt/entropy/downloads`, case-exact dirs
+  like `Movies`/`TVShows`), not `/mnt/media/*`; TZ is `America/Los_Angeles`.
+- Readarr runs `lscr.io/linuxserver/readarr:amd64-1.0.980` — LSIO ships no
+  untagged `latest` for readarr; the tag was pinned after a manifest probe.
+- Prowlarr's `/config` mount was missing mid-deploy (off-by-one in an edit);
+  restored in commit `67695cf`.
+- **Auth posture: every arr runs `AuthenticationMethod=None` +
+  `AuthenticationRequired=Enabled`** — verified live via each config.xml and by
+  probing `/api/v3/system/status` unauthenticated (401 on all five, local and
+  through the vhost). Net effect: a login screen with **zero users defined**;
+  whoever creates the first account owns the instance. Decide the auth method
+  (`None` behind the Anubis wall vs `External` via authentik) *before* WAN
+  exposure — first-account-wins is the current race condition.
+- API keys live in each `/config/config.xml` (`<ApiKey>`); they are local-only
+  secrets and stop being secret the moment a vhost serves the API unauthenticated.
 
 ## Disk Layout