media: add full library folder structure, store all secrets in Vault

- external-secrets: add qbittorrent, jellyfin, seerr keys from Vault
- pvc: document all media folder paths (movies, tv, anime, docs, standup, concerts, kids, music)
- jellyfin: init container creates all media subdirs on startup

servers/legion/k8s/media/external-secrets.yaml

@@ -1,4 +1,4 @@
-# media-secrets — ProtonVPN WireGuard credentials
+# media-secrets — ProtonVPN WireGuard credentials + service API keys
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -17,3 +17,19 @@ spec:
       remoteRef:
         key: secret/data/protonvpn
         property: private_key
+    - secretKey: QBITTORRENT_USERNAME
+      remoteRef:
+        key: secret/data/qbittorrent
+        property: username
+    - secretKey: QBITTORRENT_PASSWORD
+      remoteRef:
+        key: secret/data/qbittorrent
+        property: password
+    - secretKey: JELLYFIN_API_KEY
+      remoteRef:
+        key: secret/data/jellyfin
+        property: api_key
+    - secretKey: SEERR_API_KEY
+      remoteRef:
+        key: secret/data/seerr
+        property: api_key