Add shared arrstack Valkey and wire arr apps' Redis features

Activate the arr forks' #14 Redis features (SignalR backplane, cross-replica
cache-invalidation bus, distributed rate limiter), which ship deployed but inert
because no Valkey exists and nothing is wired.

- Add a single shared ValkeyCluster (arrstack-valkey) under apps/base/arrstack/valkey,
  modeled on jellyfin-valkey: shards:1/replicas:2 HA, image via artifactapi,
  passwordless default user, node spread + cluster PDB, ephemeral storage.
- Register the valkey component in the arrstack base kustomization.
- Wire <App>__Redis__Host/Port into the sonarr/radarr/prowlarr env ConfigMaps,
  all pointing at the shared service valkey-arrstack-valkey:6379. Host is the
  activation switch (RedisOptions.IsConfigured gates on Host; no Enabled flag).
  Passwordless (jellyfin parity) so no Password/Ssl. Per-app key/channel prefixes
  keep the three apps isolated on one cluster.

apps/base/arrstack/sonarr/configmap.yaml

@@ -22,3 +22,12 @@ data:
   Sonarr__Server__Port: "8989"
   Sonarr__Server__UrlBase: /sonarr
   Sonarr__Update__Mechanism: External
+  # Shared arrstack Valkey (valkey-operator). Setting Host is what activates the
+  # fork's #14 Redis features (SignalR backplane, cross-replica cache-invalidation
+  # bus, distributed rate limiter): RedisOptions.IsConfigured gates purely on a
+  # non-empty Host, so there is no separate Enabled flag. The operator leaves the
+  # default user passwordless (jellyfin parity), so no Password/Ssl is wired.
+  # Channels/keys are namespaced by this fork's sonarr:ratelimit: prefix, so the
+  # one cluster is safe to share with radarr/prowlarr.
+  Sonarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
+  Sonarr__Redis__Port: "6379"