arrstack: fix sync-wave deadlock + config multi-attach

The active-active arrstack deploy (#383) was stuck: the app Deployments
(wave 0) can't become Healthy without their database, so ArgoCD never
advanced to wave 1 to create the shared Postgres cluster. And /config was
an RWO cephrbd PVC, so 3 replicas hit Multi-Attach.

- move DB infra ahead of the apps: VSS + backup ObjectStoreUser/Bucket
  wave -3, CNPG Cluster -2, Databases -1 (apps stay at default 0)
- switch each app's /config to emptyDir (per-pod, stateless; library is
  in Postgres, config is env-driven; MediaCover regenerates). Old RWO
  config PVCs orphan.

apps/base/arrstack/radarr/deployment.yaml

@@ -94,8 +94,7 @@ spec:
               mountPath: /media/movies
       volumes:
         - name: config
-          persistentVolumeClaim:
-            claimName: radarr-config
+          emptyDir: {}
         - name: media-movies
           persistentVolumeClaim:
             claimName: media-movies

apps/base/arrstack/radarr/kustomization.yaml

@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - pvc-config.yaml
   - vaultstaticsecret.yaml
   - configmap.yaml
   - deployment.yaml