seerr: quadlet on dankclaw + guard-chain vhost + deployer wiring

Unit: ghcr.io/seerr-team/seerr:v3.4.1, loopback-only 5055 publish
(homepage probe; users go through Anubis->Authentik->caddy:8017->seerr),
Containers data root, no env secrets. Guard chain: seerr.franksdank.cloud
vhost behind anubis:8923 with post-auth handler on 8017; addn-hosts record;
homepage widget; deploy-remote/deploy-plan/deploy.sh routing; seam test.

dankclaw/Caddyfile

@@ -145,6 +145,13 @@ loki.franksdank.cloud {
 	}
 }
 
+# --- Seerr (guarded: Anubis → Authentik; seerr provider, internal_host caddy:8017) ---
+seerr.franksdank.cloud {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
 pihole.franksdank.cloud {
 	basicauth {
@@ -260,6 +267,11 @@ http://:8017 {
 		reverse_proxy loki:3100
 	}
 
+	@seerr host seerr.franksdank.cloud
+	handle @seerr {
+		reverse_proxy seerr:5055
+	}
+
 	@grafana host grafana.franksdank.cloud
 	handle @grafana {
 		reverse_proxy grafana:3000