arrstack,fafflix,cheeztv: provision shared mediastore CephFS volume

Adds the static PV/PVC trio for the new 10Ti "mediastore" CephFS subvolume
plus a bootstrap Job that seeds its directory tree. Purely additive: the
existing media-tv/media-movies volumes are untouched.

- add static PVs arrstack-mediastore, fafflix-mediastore, cheeztv-mediastore
  all pinned to the same rootPath on cephfs_csi_ssd_ec_4_1
- add the matching RWX 10Ti PVCs, k8up-excluded, statically bound by
  volumeName + storageClassName ""
- add mediastore-bootstrap, an ArgoCD Sync-hook Job that mkdir -p's
  /{fafflix,cheeztv}/{tvseries,movies} and /nzbget/downloads/complete as
  uid/gid 1000
- wire the new manifests into the arrstack, fafflix and cheeztv bases

apps/base/cheeztv/kustomization.yaml

@@ -15,8 +15,10 @@ resources:
   - pvc-transcode.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
+  - pv-mediastore.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
+  - pvc-mediastore.yaml
   - statefulset.yaml
   - plugin-configmap.yaml
   - pdb.yaml

apps/base/cheeztv/pv-mediastore.yaml

@@ -0,0 +1,31 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume. Same rootPath as
+# arrstack's mediastore PV so the arrs write and cheeztv reads the identical
+# library tree (cheeztv scans /cheeztv/{tvseries,movies}); each namespace gets
+# its own PV (unique name + volumeHandle) pinned by claimRef.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cheeztv-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: cheeztv
+    name: cheeztv-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: cheeztv-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1

apps/base/cheeztv/pvc-mediastore.yaml

@@ -0,0 +1,24 @@
+---
+# Shared media tree, read-many across replicas. Statically bound to the
+# cheeztv-mediastore PV (the CephFS subvolume also used by arrstack and
+# fafflix). storageClassName "" + volumeName disables dynamic provisioning and
+# binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cheeztv-mediastore
+  namespace: cheeztv
+  annotations:
+    # Exclude from the cheeztv-config k8up Schedule (skipWithoutAnnotation is
+    # false cluster-wide, so unannotated PVCs are swept in). Only cheeztv-config
+    # is backed up; the media library is not restic-backup material.
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: cheeztv-mediastore
+  volumeMode: Filesystem