Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr

- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family

servers/legion/k8s/media/external-secrets.yaml

@@ -0,0 +1,25 @@
+# media-secrets — ProtonVPN WireGuard key + Plex claim token
+# PLEX_CLAIM: run `vault kv patch secret/plex claim_token=<token>` right before first deploy
+#   Get token from: https://www.plex.tv/claim (expires in 4 minutes)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: media-secrets
+  namespace: media
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: media-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: PROTONVPN_PRIVATE_KEY
+      remoteRef:
+        key: secret/data/protonvpn
+        property: private_key
+    - secretKey: PLEX_CLAIM
+      remoteRef:
+        key: secret/data/plex
+        property: claim_token