arrstack: wire arrproxy v0.4.0 tier routing (fafflix/cheeztv)

The old bare sonarr/radarr Services are gone; arrproxy still ran the v0.3.x
default topology pointing at non-existent upstreams and dead sonarr/radarr
apikey Secrets. Cut the front door over to arrproxy v0.4.0 tier routing so the
adult (fafflix, /3aa168) and kids (cheeztv, /3df803) *arr instances are reachable
again with per-tier group authorization.

- Bump arrproxy-api and arrproxy-ui images to v0.4.0.
- Add arrproxy-tiers ConfigMap (ARRPROXY_TIERS_FILE): fafflix + cheeztv tiers,
  each with sonarr/radarr upstreams, route hash, key subdir and group grants.
  Adults (akP-media-fafflix) reach both tiers all methods; kids
  (akP-media-cheeztv) reach only cheeztv, GET/HEAD. legacyRoutes:false retires
  the unprefixed routes. arrproxy strips /<hash> and proxies /<app>/..., so each
  upstream URL carries the /<hash> path segment to line up with the *arr's own
  UrlBase (/3aa168/sonarr etc.).
- Mount the tiers file and rework the projected keys volume to the real
  per-instance {sonarr,radarr}-{adult,kids}-apikey Secrets under <keyDir>/<app>
  (adult/*, kids/*); refresh the reloader annotations.
- oauth2-proxy: route /3aa168 and /3df803 to arrproxy-api (drop dead
  /sonarr /radarr /prowlarr; prowlarr is served directly), and widen
  SKIP_AUTH_REGEX to ^/[^/]+/[^/]+/api for the hash-prefixed tier api paths.

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -31,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.3.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.4.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080