qBittorrent pinned to 4.6.7; all five download clients live-verified

- qB 5.x's 204 login breaks Readarr's retired client at runtime; 4.6.7 answers
  legacy 200+Ok. Pin recorded in the unit and documented.
- Prowlarr download client created via schema template; all five clients test
  200 through the podman gateway.
- PBKDF2 gotcha: qB 5.x conf rewrite left a hash 4.6.7 rejects; fresh rewrite
  of the same line restored login.
- E2E: torrent through the Panama tunnel at ~17 MB/s, completed into Finished
  Torrents, deleted with data.

serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md

@@ -84,7 +84,11 @@ are unaffected.
   (mode 600, VM-local) for the arr wiring. The first seed wrote the hash
   under the legacy `WebUI\Password` key (silently ignored → every client
   got `Unauthenticated`); the live conf was patched and
-  `scripts/deploy-remote.sh` fixed to write the `_PBKDF2` key.
+  `scripts/deploy-remote.sh` fixed to write the `_PBKDF2` key. Gotcha
+  (live, 2026-09-01): after qB 5.x ran, its conf rewrite left a hash line
+  4.6.7 rejects (`invalid credentials` for every login, including the arrs);
+  rewriting the same `@ByteArray` line fresh (same password, 100k
+  iterations) restored login. Any future version flip: regenerate the line.
 - `HostHeaderValidation=false` + `ServerDomains=*`: the socat forwarder
   preserves the LAN `Host` header, which would otherwise be rejected.
 - **Save-path convention**: `Session\DefaultSavePath=/Volumes/COMPLETE/
@@ -96,20 +100,30 @@ are unaffected.
   files onward; nothing writes to the entropy volume.
 - Categories seeded: `Finished Torrents`, `lidarr`, `radarr`, `readarr`,
   `tv-sonarr` (all → `Finished Torrents`).
-- **Download clients** (gateway `10.88.0.1:8080`, user `admin`): sonarr
-  (`tv-sonarr`), radarr, lidarr created via API, live tests pass. Readarr's
-  was transplanted by direct `readarr.db` row insert (app stopped): its EOL
+- **Download clients** (gateway `10.88.0.1:8080`, user `admin`): all five test
+  green against live qB — sonarr (`tv-sonarr`), radarr, lidarr, readarr
+  (rows pre-created in the prior session; passwords re-pushed via API), and
+  prowlarr (created from the `/downloadclient/schema` template — a
+  hand-minimal body 400s in Prowlarr's create-time test). Readarr's EOL
   validator (last release 2023) rejects qB ≥ 5's `204` empty login success
-  as "Authentication failure", so an API create can never pass; runtime
-  cookie auth is unaffected. Treat readarr as best-effort.
+  as "Authentication failure" — that kills runtime auth too, not just API
+  creates; the fix was pinning qB itself (below), after which readarr tests
+  200 like the rest.
+- **qB pinned to 4.6.7** (`Image=lscr.io/linuxserver/qbittorrent:4.6.7`,
+  not `latest`): `latest` resolved to 5.x, whose `204` login breaks
+  Readarr's frozen client; 4.6.7 answers the legacy `200` + `"Ok."` that
+  every client accepts. Pinned in
+  `frankbook-pro/qbittorrent/quadlet/qbittorrent.container`.
 - **Prowlarr Applications** push to sonarr/radarr/lidarr (`fullSync`,
   gateway ports). Readarr deliberately omitted: prowlarr's indexer-push
   test to readarr's `/api/v1/indexer/test` 500s (EOL schema drift).
   Legacy `Prowlarr-*` indexer rows carried in the migrated dankserver DBs
   pointed at the unresolvable hostname `prowlarr:9696` and were deleted;
   the current `*(Prowlarr)` entries test OK.
-- **E2E proven**: qB fetched a `.torrent` through the tunnel, downloaded at
-  ~19 MB/s, completed into `Finished Torrents`.
+- **E2E proven (2026-09-01, on 4.6.7)**: added a legal test torrent via the
+  API with category `Finished Torrents` — downloaded through the tunnel
+  (~17 MB/s), qB moved it INCOMPLETE → COMPLETE into
+  `/Volumes/COMPLETE/Finished Torrents`, then deleted with data.
 
 # Citations
 

serverAppConfigs-docs/log.md

@@ -312,3 +312,7 @@ timestamp: 2026-09-14
 - `/serverAppConfigs-docs/Dankclaw/Seerr.md`, `/serverAppConfigs-docs/index.md` — service doc + index entry.
 - Lessons: rootless podman uid mapping is continuous (container N → host 100000+N-1; uid 1000 → 100999 — an off-by-one chown EACCES-crash-looped first boot); new quadlet bind-source dirs must pre-exist on target (statfs 125 otherwise); new vhost TLS issues at Caddy reload (~15 s dns-01), not at first request.
 - Authentik outpost claim cache fixed (root cause of the persistent `/admin` 403 despite homepage-admins membership): the outpost serves per-browser-session claims from `authentik_providers_proxy_proxysession` until row expiry — akadmin's live row predated the group add and carried `["authentik Admins"]` only, and the 403 never generates an authentik event. Deleted his 4 rows; the next visit re-authorizes silently against the untouched authentik login session. Silent re-auth proven live: deleted qa-e2e-admin's 13 rows, ran the e2e admin spec against the stale storage state — 2 passed in 2.9 s, no login prompt. Mechanism + diagnosis SQL documented in `/serverAppConfigs-docs/Infrastructure/Authentik.md` (new "Outpost claim cache" section + failure-mode row); the doc's data-path references updated to the 2026-09-01 Containers layout.
+- WireGuard credentials provisioned (Panama PA-12 conf → gluetun env inside the VM): tunnel egress verified (exit IP Panama, not residential), qB WebUI published per plan, and Prowlarr → qBittorrent wired — all five download clients (prowlarr, sonarr, radarr, lidarr, readarr) test 200 against live qB through the podman gateway `10.88.0.1:8080`; Prowlarr's client created via its `/downloadclient/schema` template (hand-minimal body 400s on create-time test).
+- `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it.
+- `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data).
+- `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing.