Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr

- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family

servers/legion/media.tf

@@ -0,0 +1,13 @@
+# Media stack — Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr
+# Namespace only — all resources managed by Argo CD
+# See: apps/media.yaml, k8s/media/
+
+resource "kubernetes_namespace" "media" {
+  metadata {
+    name = "media"
+    labels = {
+      managed-by = "terraform"
+      tier       = "apps"
+    }
+  }
+}