arrstack: fix sync-wave deadlock + config multi-attach (#385)

## Why
The active-active arrstack deploy (#383) is stuck in-cluster: the app Deployments (sync-wave 0) can never become Healthy without their Postgres DB, so ArgoCD never advances to create the shared `arrstack-postgres` cluster (wave 1). Separately, `/config` is an immutable RWO cephrbd PVC, so 3 replicas fail with Multi-Attach.

## How
- Order DB infra before the apps: `<app>-db` VaultStaticSecrets + backup ObjectStoreUser/Bucket at sync-wave -3, CNPG `Cluster` -2, `Database` CRDs -1; app Deployments stay at default 0.
- Switch each app's `/config` to an emptyDir per-pod volume (library DB is in Postgres, config is env-driven; MediaCover regenerates). Old RWO config PVCs orphan.

Validated with kustomize build (62 resources). arrproxy/nzbget untouched.

Reviewed-on: #385
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -11,11 +11,6 @@ kind: Cluster
 metadata:
   name: arrstack-postgres
   namespace: arrstack
-  annotations:
-    # Wave 1: the per-app <app>-db Secrets (wave 0) must exist first — CNPG reads
-    # them as the managed roles' passwordSecret. ArgoCD gates dependents on the
-    # Cluster's health status.
-    argocd.argoproj.io/sync-wave: "1"
 spec:
   inheritedMetadata:
     annotations:

apps/base/arrstack/postgres/database-prowlarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: prowlarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/database-radarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: radarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: sonarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
 spec:
   cluster:
     name: arrstack-postgres

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -13,8 +13,6 @@ kind: VaultStaticSecret
 metadata:
   name: sonarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
 spec:
   destination:
     create: true
@@ -32,8 +30,6 @@ kind: VaultStaticSecret
 metadata:
   name: radarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
 spec:
   destination:
     create: true
@@ -51,8 +47,6 @@ kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
 spec:
   destination:
     create: true