arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)

The old bare sonarr/radarr Services are gone; arrproxy still ran the v0.3.x
default topology pointing at non-existent upstreams and dead sonarr/radarr
apikey Secrets. Cut the front door over to arrproxy v0.4.0 tier routing so the
adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable
again with per-tier group authorization.

- Bump arrproxy-api and arrproxy-ui images to v0.4.0.
- Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers,
  each with sonarr/radarr upstreams, route hash, key subdir and group grants.
  Adults (akP-media-fafflix) reach both tiers all methods; kids
  (akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires
  the unprefixed routes. arrproxy strips /<hash> and proxies /<app>/..., so each
  upstream URL carries the /<hash> path segment to line up with the *arr's own
  UrlBase (/3aa168/sonarr etc.).
- Mount the tiers file and rework the projected keys volume to the real
  per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app>
  (adult/*, kids/*); refresh the reloader annotations.
- oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead
  /sonarr /radarr /prowlarr; prowlarr is served directly), and widen
  SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -7,7 +7,8 @@ metadata:
   annotations:
     # Wave 2: serve only after the wave-1 migrate Job completes.
     argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-adult-apikey,radarr-adult-apikey,sonarr-kids-apikey,radarr-kids-apikey"
+    configmap.reloader.stakater.com/reload: "arrproxy-tiers"
 spec:
   replicas: 2
   selector:
@@ -33,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.3.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.4.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -49,11 +50,18 @@ spec:
             # reaches this upstream) so group-based authorization works.
             - name: ARRPROXY_GROUPS_HEADER
               value: X-Forwarded-Groups
-            # Real per-app *arr keys, projected one file per app under this dir
-            # (sourced from the existing <app>-apikey Secrets). The api injects
-            # them server-side and redacts them from every proxied response.
+            # Real per-app *arr keys, projected one file per app under a per-tier
+            # subdir (<keyDir>/<app>) matching the tiers file: adult/{sonarr,radarr}
+            # and kids/{sonarr,radarr}. Sourced from the same <instance>-apikey
+            # Secrets the *arr Deployments consume. The api injects them server-side
+            # and redacts them from every proxied response.
             - name: ARRPROXY_KEYS_DIR
               value: /etc/arrproxy/keys
+            # Tier topology (fafflix/cheeztv): upstreams, route hashes, key subdirs
+            # and group grants. Legacy unprefixed routes are retired in the file
+            # (legacyRoutes:false); see arrproxy-tiers ConfigMap.
+            - name: ARRPROXY_TIERS_FILE
+              value: /etc/arrproxy/tiers/tiers.json
             - name: ARRPROXY_PEPPER
               valueFrom:
                 secretKeyRef:
@@ -86,6 +94,9 @@ spec:
             - name: arr-keys
               mountPath: /etc/arrproxy/keys
               readOnly: true
+            - name: tiers
+              mountPath: /etc/arrproxy/tiers
+              readOnly: true
             - name: tmp
               mountPath: /tmp
           livenessProbe:
@@ -118,27 +129,37 @@ spec:
               cpu: "1"
               memory: 512Mi
       volumes:
-        # Real *arr API keys, one file per app named exactly <app> so the api
-        # reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
-        # <app>-apikey Secrets the *arr Deployments already consume.
+        # Real per-tier *arr API keys, projected as <keyDir>/<app> so the api
+        # reads /etc/arrproxy/keys/{adult,kids}/{sonarr,radarr} (matching the
+        # tiers file keyDir). Reuses the same <instance>-apikey Secrets the *arr
+        # Deployments already consume (seeded by their VaultStaticSecrets).
         - name: arr-keys
           projected:
             sources:
               - secret:
-                  name: sonarr-apikey
+                  name: sonarr-adult-apikey
                   items:
                     - key: apitoken
-                      path: sonarr
+                      path: adult/sonarr
               - secret:
-                  name: radarr-apikey
+                  name: radarr-adult-apikey
                   items:
                     - key: apitoken
-                      path: radarr
+                      path: adult/radarr
               - secret:
-                  name: prowlarr-apikey
+                  name: sonarr-kids-apikey
                   items:
                     - key: apitoken
-                      path: prowlarr
+                      path: kids/sonarr
+              - secret:
+                  name: radarr-kids-apikey
+                  items:
+                    - key: apitoken
+                      path: kids/radarr
+        # Tier topology JSON (ARRPROXY_TIERS_FILE).
+        - name: tiers
+          configMap:
+            name: arrproxy-tiers
         - name: tmp
           emptyDir:
             sizeLimit: 64Mi