arrstack: rebuild adult tier on the shared-Postgres pattern

Replace the legacy adult sonarr/radarr/nzbget with the kids-tier pattern
(active-active -unkin fork on shared arrstack-postgres + Valkey, S3
MediaCover/Backup, exportarr metrics). The old adult apps held no data, so
the wipe is sanctioned.

- add sonarr-adult/radarr-adult/nzbget-adult (copies of the *-kids dirs):
  own DBs sonarr-adult-main/radarr-adult-main, Vault paths
  .../default/{sonarr,radarr}-adult(+-db), S3 prefixes sonarr-adult/
  radarr-adult, UrlBase + probe + exportarr paths /3aa168/{sonarr,radarr},
  media subPaths tvshows/adult + movies/adult, nzbget config PVC on
  cephrbd-fast-delete
- postgres: add managed roles sonarr-adult/radarr-adult, Database CRDs
  {sonarr,radarr}-adult-main, VaultStaticSecrets {sonarr,radarr}-adult-db
- remove legacy sonarr/radarr/nzbget dirs (incl. their gateway/httproute),
  managed roles sonarr/radarr, databases {sonarr,radarr}-main, VSS
  {sonarr,radarr}-db, and all kustomization entries

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -50,30 +50,6 @@ spec:
       owner: app
   managed:
     roles:
-      - name: sonarr
-        ensure: present
-        comment: Sonarr application role (owns sonarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: sonarr-db
-      - name: radarr
-        ensure: present
-        comment: Radarr application role (owns radarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: radarr-db
       - name: prowlarr
         ensure: present
         comment: Prowlarr application role (owns prowlarr-main)
@@ -110,6 +86,30 @@ spec:
         connectionLimit: -1
         passwordSecret:
           name: radarr-kids-db
+      - name: sonarr-adult
+        ensure: present
+        comment: Sonarr (adult) application role (owns sonarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: sonarr-adult-db
+      - name: radarr-adult
+        ensure: present
+        comment: Radarr (adult) application role (owns radarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: radarr-adult-db
   enablePDB: true
   enableSuperuserAccess: false
   failoverDelay: 0

apps/base/arrstack/postgres/database-radarr-adult.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the radarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: radarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: radarr-adult-main
+  owner: radarr-adult
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-radarr.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the radarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: radarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: radarr-main
-  owner: radarr
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr-adult.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the sonarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sonarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: sonarr-adult-main
+  owner: sonarr-adult
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the sonarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: sonarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: sonarr-main
-  owner: sonarr
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/kustomization.yaml

@@ -6,8 +6,8 @@ resources:
   - vaultstaticsecret.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
-  - database-sonarr.yaml
-  - database-radarr.yaml
   - database-prowlarr.yaml
   - database-sonarr-kids.yaml
   - database-radarr-kids.yaml
+  - database-sonarr-adult.yaml
+  - database-radarr-adult.yaml

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -10,40 +10,6 @@
 # (wave 1) reconciles the roles.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
-metadata:
-  name: sonarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: sonarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: radarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
@@ -92,3 +58,37 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: sonarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: radarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default