seerr: quadlet on dankclaw + guard-chain vhost + deployer wiring

Unit: ghcr.io/seerr-team/seerr:v3.4.1, loopback-only 5055 publish
(homepage probe; users go through Anubis->Authentik->caddy:8017->seerr),
Containers data root, no env secrets. Guard chain: seerr.franksdank.cloud
vhost behind anubis:8923 with post-auth handler on 8017; addn-hosts record;
homepage widget; deploy-remote/deploy-plan/deploy.sh routing; seam test.

scripts/deploy-remote.sh

@@ -89,7 +89,7 @@ service_is_allowed() {
         dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|\
         dankclaw:authentik-postgres|dankclaw:authentik-server|\
         dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
-        dankclaw:caddy|dankclaw:homepage|\
+        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|\
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankclaw:frank-default-sightsound|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
@@ -952,6 +952,11 @@ VM_START
     echo "  $service answers on 127.0.0.1:$port"
 }
 
+deploy_seerr() {
+    install_quadlet seerr dankclaw/seerr/quadlet seerr
+    systemctl --user restart seerr.service
+}
+
 deploy_service() {
     local service="$1"
     if [[ "$TARGET" == "frankbook-pro" ]]; then
@@ -977,6 +982,7 @@ deploy_service() {
             deploy_authentik_outpost
             ;;
         anubis) deploy_anubis ;;
+        seerr) deploy_seerr ;;
         frank-default-large) deploy_llm_large ;;
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;