Add Fornax worker pods — US-TX#253 and US-TX#34

Two initial Fornax distributed torrent workers, each a gluetun+qBittorrent+natpmpc-helper
pod on a different ProtonVPN TX server with NAT-PMP enabled. VPN private keys stored in
Vault at secret/fornax/worker-tx253 and secret/fornax/worker-tx34, surfaced via
ExternalSecrets. Workers share the media-data PVC; each has its own config PVC.

Services: fornax-worker-tx253:8080 and fornax-worker-tx34:8080 (ClusterIP, media ns)

servers/legion/k8s/media/pvc.yaml

@@ -132,3 +132,30 @@ spec:
   resources:
     requests:
       storage: 1Gi
+---
+# Fornax worker config PVCs — one per worker pod (qBittorrent config + state)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fornax-worker-tx253-config
+  namespace: media
+spec:
+  storageClassName: local-path
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fornax-worker-tx34-config
+  namespace: media
+spec:
+  storageClassName: local-path
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi