Initial commit — MediaStack VM config and documentation

VM 113 on PVE1: Sonarr/Radarr/Prowlarr/qBittorrent behind WireGuard VPN.
All traffic exits through DO server, bypassing home ISP.
NFS exports movies and TV to Jellyfin (VM 112).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/systemd/qbittorrent.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=qBittorrent-nox
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=qbittorrent
+Group=qbittorrent
+ExecStart=/usr/bin/qbittorrent-nox --webui-port=8080
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target