gluetun: switch to protonvpn provider with port forwarding enabled

Custom WireGuard mode doesn't support NAT-PMP port forwarding — peers
can't connect inbound so most torrents stall. Switching to protonvpn
provider with SERVER_FEATURES=p2p picks a port-forwarding-capable server
and VPN_PORT_FORWARDING=on handles the NAT-PMP handshake. Up command
updates qBittorrent listen port automatically when gluetun gets the port.

servers/legion/k8s/media/gluetun-qbittorrent.yaml

@@ -35,7 +35,7 @@ spec:
               add: ["NET_ADMIN"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: "custom"
+              value: "protonvpn"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -43,19 +43,22 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: WIREGUARD_PUBLIC_KEY
-              value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
-            - name: WIREGUARD_ADDRESSES
-              value: "10.2.0.2/32"
-            - name: VPN_ENDPOINT_IP
-              value: "95.173.217.29"
-            - name: VPN_ENDPOINT_PORT
-              value: "51820"
+            # Pick a US P2P server — P2P servers support port forwarding
+            - name: SERVER_COUNTRIES
+              value: "United States"
+            - name: SERVER_FEATURES
+              value: "p2p"
+            # Port forwarding via NAT-PMP — lets peers connect inbound, fixes slow/stalled downloads
+            - name: VPN_PORT_FORWARDING
+              value: "on"
+            # When gluetun gets a forwarded port, tell qBittorrent to listen on it
+            - name: VPN_PORT_FORWARDING_UP_COMMAND
+              value: "/bin/sh -c 'curl -s -c /tmp/pf.jar -X POST http://localhost:8080/api/v2/auth/login -d username=admin&password=adminadmin >/dev/null && curl -s -b /tmp/pf.jar -X POST http://localhost:8080/api/v2/app/setPreferences -d \"json={\\\"listen_port\\\":{{FORWARDED_PORT}}}\"'"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
             - name: UPDATER_PERIOD
-              value: "0"
+              value: "24h"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: