arrstack: provision shared Ceph RGW bucket for media assets

Servarr MediaCover (posters/fanart) and backups currently live on each
replica's local /config, which is an emptyDir - so covers a leader downloads
are invisible to the other replicas behind the Service. Provision a shared S3
bucket to hold these assets instead.

- Add an arrstack-media ObjectStoreUser + Bucket (cephrgw-operator), mirroring
  the CNPG backup pattern; the operator mints the arrstack-media-s3 credential
  Secret in-namespace, so no Vault KV seeding is required.
- Wire the radarr Deployment to the bucket via Radarr__MediaCover__S3__* env
  (creds from the operator Secret, estate CA mounted for RGW TLS). Unknown to
  the current image and activated by the -unkin3+ MediaCover-S3 build; sonarr
  and prowlarr wiring follow.

apps/base/arrstack/radarr/deployment.yaml

@@ -102,6 +102,33 @@ spec:
                 secretKeyRef:
                   name: radarr-apikey
                   key: apitoken
+            # MediaCover object store (shared Ceph RGW bucket). Serves posters/fanart
+            # from S3 so any replica can render them instead of the leader-local
+            # emptyDir /config. Consumed by the -unkin3+ image; older images ignore
+            # these unknown config keys. Creds Secret is minted by cephrgw-operator.
+            - name: Radarr__MediaCover__S3__Endpoint
+              valueFrom:
+                secretKeyRef:
+                  name: arrstack-media-s3
+                  key: S3_ENDPOINT
+            - name: Radarr__MediaCover__S3__AccessKey
+              valueFrom:
+                secretKeyRef:
+                  name: arrstack-media-s3
+                  key: AWS_ACCESS_KEY_ID
+            - name: Radarr__MediaCover__S3__SecretKey
+              valueFrom:
+                secretKeyRef:
+                  name: arrstack-media-s3
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: Radarr__MediaCover__S3__Bucket
+              value: arrstack-media
+            - name: Radarr__MediaCover__S3__Prefix
+              value: radarr
+            - name: Radarr__MediaCover__S3__ForcePathStyle
+              value: "true"
+            - name: Radarr__MediaCover__S3__CaCertPath
+              value: /etc/ssl/vault-ca/ca.crt
           livenessProbe:
             httpGet:
               path: /radarr/ping
@@ -130,9 +157,19 @@ spec:
               mountPath: /config
             - name: media-movies
               mountPath: /media/movies
+            - name: vault-ca
+              mountPath: /etc/ssl/vault-ca
+              readOnly: true
       volumes:
         - name: config
           emptyDir: {}
         - name: media-movies
           persistentVolumeClaim:
             claimName: media-movies
+        # Estate CA for validating the Ceph RGW (s3.ceph.unkin.net) TLS cert.
+        - name: vault-ca
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt