seerr: quadlet on dankclaw + guard-chain vhost + deployer wiring

Unit: ghcr.io/seerr-team/seerr:v3.4.1, loopback-only 5055 publish
(homepage probe; users go through Anubis->Authentik->caddy:8017->seerr),
Containers data root, no env secrets. Guard chain: seerr.franksdank.cloud
vhost behind anubis:8923 with post-auth handler on 8017; addn-hosts record;
homepage widget; deploy-remote/deploy-plan/deploy.sh routing; seam test.

dankclaw/seerr/quadlet/seerr.container

@@ -0,0 +1,43 @@
+# Quadlet unit: Seerr media request manager (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/seerr.container
+# Unit name: seerr.service (container name: seerr)
+#
+# Seerr is the unified Overseerr/Jellyseerr successor. It fronts the
+# *arr stack now living on FrankBook-Pro (192.168.0.112, resolved via the
+# Pi-hole addn-hosts record frankbook-pro.lan): requests are placed here,
+# routed through the arrs over the LAN, and downloads run inside the Mac's
+# gluetun tunnel. SQLite lives under /home/dank/Containers/seerr/data —
+# no separate database unit (decision D8).
+#
+# Exposure contract: the ONLY published port is loopback (127.0.0.1:5055)
+# for the homepage probe and host-local checks. User traffic must traverse
+# the guard chain: Caddy TLS edge → Anubis :8923 → Authentik outpost →
+# Caddy :8017 post-auth listener → seerr:5055 on dankclaw_default. Never
+# publish 5055 on a LAN or public address.
+#
+# Image pin: ghcr.io/seerr-team/seerr:v3.4.1 (manifest-verified on GHCR
+# 2026-09-01; released 2026-07-30). Upgrade = bump the tag, redeploy.
+#
+# No secrets in this file: OIDC (Authentik) and arr API keys live in
+# Seerr's own settings store inside the data volume, configured at runtime.
+
+[Unit]
+Description=Seerr media request manager container
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+ContainerName=seerr
+Image=ghcr.io/seerr-team/seerr:v3.4.1
+Network=dankclaw_default
+PublishPort=127.0.0.1:5055:5055
+Volume=/home/dank/Containers/seerr/data:/app/config
+
+[Service]
+Restart=always
+RestartSec=5
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target