arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)

The old bare sonarr/radarr Services are gone; arrproxy still ran the v0.3.x
default topology pointing at non-existent upstreams and dead sonarr/radarr
apikey Secrets. Cut the front door over to arrproxy v0.4.0 tier routing so the
adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable
again with per-tier group authorization.

- Bump arrproxy-api and arrproxy-ui images to v0.4.0.
- Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers,
  each with sonarr/radarr upstreams, route hash, key subdir and group grants.
  Adults (akP-media-fafflix) reach both tiers all methods; kids
  (akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires
  the unprefixed routes. arrproxy strips /<hash> and proxies /<app>/..., so each
  upstream URL carries the /<hash> path segment to line up with the *arr's own
  UrlBase (/3aa168/sonarr etc.).
- Mount the tiers file and rework the projected keys volume to the real
  per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app>
  (adult/*, kids/*); refresh the reloader annotations.
- oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead
  /sonarr /radarr /prowlarr; prowlarr is served directly), and widen
  SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.

apps/base/arrstack/arrproxy/tiers-configmap.yaml

@@ -0,0 +1,53 @@
+---
+# arrproxy v0.4.0 tier topology (ARRPROXY_TIERS_FILE). Two isolated instance
+# tiers, each with its own *arr backends, real-key subdir, and group grants:
+#   fafflix (adult, /3aa168/*) and cheeztv (kids, /3df803/*).
+# arrproxy strips the /<hash> route prefix and proxies "/<app>/..." upstream, so
+# each app's upstream URL carries the "/<hash>" path segment: the joined upstream
+# path (/3aa168/sonarr/...) then matches the *arr's own UrlBase (/3aa168/sonarr).
+# Access: the adult group reaches BOTH tiers with any method; the kids group
+# reaches ONLY the cheeztv tier and only GET/HEAD. Groups arrive on the
+# hierarchical Authentik ak_groups claim, forwarded by oauth2-proxy as
+# X-Forwarded-Groups. Legacy unprefixed routes are retired (legacyRoutes:false);
+# the old bare sonarr/radarr Services no longer exist.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arrproxy-tiers
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+data:
+  tiers.json: |
+    {
+      "legacyTier": "fafflix",
+      "legacyRoutes": false,
+      "tiers": [
+        {
+          "name": "fafflix",
+          "hash": "3aa168",
+          "keyDir": "adult",
+          "grants": [
+            { "group": "akP-media-fafflix" }
+          ],
+          "apps": [
+            { "name": "sonarr", "upstream": "http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168", "urlBase": "/3aa168/sonarr" },
+            { "name": "radarr", "upstream": "http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168", "urlBase": "/3aa168/radarr" }
+          ]
+        },
+        {
+          "name": "cheeztv",
+          "hash": "3df803",
+          "keyDir": "kids",
+          "readOnly": true,
+          "grants": [
+            { "group": "akP-media-fafflix" },
+            { "group": "akP-media-cheeztv", "methods": ["GET", "HEAD"] }
+          ],
+          "apps": [
+            { "name": "sonarr", "upstream": "http://sonarr-kids.arrstack.svc.cluster.local:8989/3df803", "urlBase": "/3df803/sonarr" },
+            { "name": "radarr", "upstream": "http://radarr-kids.arrstack.svc.cluster.local:7878/3df803", "urlBase": "/3df803/radarr" }
+          ]
+        }
+      ]
+    }