arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres (#arrstack)

Convert the three *arr apps from single-replica upstream LinuxServer/SQLite to
our -unkin2 forks running active-active (replicas 3) on a shared CNPG Postgres
cluster.

- new apps/base/arrstack/postgres/: CNPG Cluster arrstack-postgres (3 instances,
  3 managed login roles sonarr/radarr/prowlarr, throwaway initdb owner), per-app
  Database CRDs (<app>-main), cephrgw backup bucket + nightly ScheduledBackup,
  and 3 VaultStaticSecrets syncing the <app>-db role credentials.
- per app: image -> docker-internal/<app>:v<base>-unkin2; replicas 3 +
  RollingUpdate; drop the apikey-init initContainer + PUID/PGID/TZ; run the
  binary directly with -nosingleinstancecheck; env from a new ConfigMap plus
  Postgres user/password and the API key from Secrets; /config PVC -> RWX
  cephfs-raid5-retain (shared).

apps/base/arrstack/radarr/pvc-config.yaml

@@ -1,6 +1,7 @@
 ---
-# Radarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
-# does not tolerate CephFS locking. Retain: this is state.
+# Radarr /config. RWX on CephFS so all replicas share it (the -unkin2 fork keeps
+# the database in Postgres; /config now holds only config.xml + MediaCover, which
+# tolerate — and want — shared access). Retain: this is state.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -8,9 +9,9 @@ metadata:
   namespace: arrstack
 spec:
   accessModes:
-    - ReadWriteOnce
+    - ReadWriteMany
   resources:
     requests:
       storage: 5Gi
-  storageClassName: cephrbd-fast-retain
+  storageClassName: cephfs-raid5-retain
   volumeMode: Filesystem