arrstack: fix sync-wave deadlock + config multi-attach

The active-active arrstack deploy (#383) was stuck: the app Deployments
(wave 0) can't become Healthy without their database, so ArgoCD never
advanced to wave 1 to create the shared Postgres cluster. And /config was
an RWO cephrbd PVC, so 3 replicas hit Multi-Attach.

- move DB infra ahead of the apps: VSS + backup ObjectStoreUser/Bucket
  wave -3, CNPG Cluster -2, Databases -1 (apps stay at default 0)
- switch each app's /config to emptyDir (per-pod, stateless; library is
  in Postgres, config is env-driven; MediaCover regenerates). Old RWO
  config PVCs orphan.

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -14,7 +14,7 @@ metadata:
   name: sonarr-db
   namespace: arrstack
   annotations:
-    argocd.argoproj.io/sync-wave: "0"
+    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -33,7 +33,7 @@ metadata:
   name: radarr-db
   namespace: arrstack
   annotations:
-    argocd.argoproj.io/sync-wave: "0"
+    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -52,7 +52,7 @@ metadata:
   name: prowlarr-db
   namespace: arrstack
   annotations:
-    argocd.argoproj.io/sync-wave: "0"
+    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true