fix(gluetun): pin to US-TX#457 server to restore downloads

The protonvpn named provider rotates through P2P servers and DNS
health checks were failing on every server it tried. Switching back
to custom provider pinned to the specific US-TX#457 server/key combo
from the ProtonVPN conf file, which is confirmed to work.

This sacrifices automatic port forwarding but restores stable downloads.

servers/legion/k8s/media/gluetun-qbittorrent.yaml

@@ -34,8 +34,9 @@ spec:
             capabilities:
               add: ["NET_ADMIN"]
           env:
+            # Use custom provider pinned to US-TX#457 — this specific server+key combo is confirmed working
             - name: VPN_SERVICE_PROVIDER
-              value: "protonvpn"
+              value: "custom"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -43,22 +44,18 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # Pick a US P2P server — P2P servers support port forwarding
-            - name: SERVER_COUNTRIES
-              value: "United States"
-            - name: SERVER_FEATURES
-              value: "p2p"
-            # Port forwarding via NAT-PMP — lets peers connect inbound, fixes slow/stalled downloads
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            # When gluetun gets a forwarded port, tell qBittorrent to listen on it
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: "/bin/sh -c 'curl -s -c /tmp/pf.jar -X POST http://localhost:8080/api/v2/auth/login -d username=admin&password=adminadmin >/dev/null && curl -s -b /tmp/pf.jar -X POST http://localhost:8080/api/v2/app/setPreferences -d \"json={\\\"listen_port\\\":{{FORWARDED_PORT}}}\"'"
+            # US-TX#457 server — generated from ProtonVPN portal with NAT-PMP=on
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "95.173.217.219"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
-            - name: UPDATER_PERIOD
-              value: "24h"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: