arrstack: rebuild adult tier on the shared-Postgres pattern (#414)

## Why
Rebuild the ADULT arr tier on the same shared-Postgres, active-active pattern the kids tier now uses, replacing the legacy adult sonarr/radarr/nzbget. The old adult apps hold **no data**, so the wipe is sanctioned.

**Stacked on** `benvin/arrstack-kids` (#412) — review/merge that first.

## How
- **Add** `sonarr-adult` / `radarr-adult` / `nzbget-adult` (copies of the `*-kids` dirs, `s/kids/adult`):
  - own DBs `sonarr-adult-main` / `radarr-adult-main`, Vault paths `.../default/{sonarr,radarr}-adult(+-db)`
  - S3 prefixes `sonarr-adult` / `radarr-adult`; UrlBase + probe + exportarr URLs `/3aa168/{sonarr,radarr}` (adult hash)
  - media subPaths `tvshows/adult` + `movies/adult`; nzbget config PVC on `cephrbd-fast-delete`
- **postgres**: add managed roles `sonarr-adult`/`radarr-adult`, Database CRDs `{sonarr,radarr}-adult-main`, VaultStaticSecrets `{sonarr,radarr}-adult-db`
- **Remove** legacy `sonarr`/`radarr`/`nzbget` dirs (incl. their gateway/httproute), managed roles `sonarr`/`radarr`, databases `{sonarr,radarr}-main`, VSS `{sonarr,radarr}-db`, and all kustomization entries
- Third-party images stay canonical upstream; in-house images stay explicit `docker-internal`

`prowlarr`, `arrproxy`, and everything else untouched. arrproxy path re-wiring is a later PR.

Verified: `kustomize build` + `kubeconform` (87/87 valid), no dangling refs to removed apps, no `3df803` in adult files.
Reviewed-on: #414
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -50,30 +50,6 @@ spec:
       owner: app
   managed:
     roles:
-      - name: sonarr
-        ensure: present
-        comment: Sonarr application role (owns sonarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: sonarr-db
-      - name: radarr
-        ensure: present
-        comment: Radarr application role (owns radarr-main)
-        login: true
-        superuser: false
-        createdb: false
-        createrole: false
-        inherit: true
-        replication: false
-        connectionLimit: -1
-        passwordSecret:
-          name: radarr-db
       - name: prowlarr
         ensure: present
         comment: Prowlarr application role (owns prowlarr-main)
@@ -110,6 +86,30 @@ spec:
         connectionLimit: -1
         passwordSecret:
           name: radarr-kids-db
+      - name: sonarr-adult
+        ensure: present
+        comment: Sonarr (adult) application role (owns sonarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: sonarr-adult-db
+      - name: radarr-adult
+        ensure: present
+        comment: Radarr (adult) application role (owns radarr-adult-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: radarr-adult-db
   enablePDB: true
   enableSuperuserAccess: false
   failoverDelay: 0

apps/base/arrstack/postgres/database-radarr-adult.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the radarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: radarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: radarr-adult-main
+  owner: radarr-adult
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-radarr.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the radarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: radarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: radarr-main
-  owner: radarr
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr-adult.yaml

@@ -0,0 +1,15 @@
+---
+# Per-app database owned by the sonarr-adult managed role. The fork's provider
+# runs its own schema migrations on first start (advisory-locked, so only one
+# replica migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sonarr-adult-main
+  namespace: arrstack
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: sonarr-adult-main
+  owner: sonarr-adult
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -1,15 +0,0 @@
----
-# Per-app database owned by the sonarr managed role. The fork's provider runs its
-# own schema migrations on first start (advisory-locked, so only one replica
-# migrates). retain: the database survives a Database CRD delete.
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: sonarr-main
-  namespace: arrstack
-spec:
-  cluster:
-    name: arrstack-postgres
-  name: sonarr-main
-  owner: sonarr
-  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/kustomization.yaml

@@ -6,8 +6,8 @@ resources:
   - vaultstaticsecret.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
-  - database-sonarr.yaml
-  - database-radarr.yaml
   - database-prowlarr.yaml
   - database-sonarr-kids.yaml
   - database-radarr-kids.yaml
+  - database-sonarr-adult.yaml
+  - database-radarr-adult.yaml

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -10,40 +10,6 @@
 # (wave 1) reconciles the roles.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
-metadata:
-  name: sonarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: sonarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/sonarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: radarr-db
-  namespace: arrstack
-spec:
-  destination:
-    create: true
-    name: radarr-db
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/arrstack/default/radarr-db
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
@@ -92,3 +58,37 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: sonarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-adult-db
+  namespace: arrstack
+spec:
+  destination:
+    create: true
+    name: radarr-adult-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-adult-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default