Initial commit — MediaStack VM config and documentation

VM 113 on PVE1: Sonarr/Radarr/Prowlarr/qBittorrent behind WireGuard VPN.
All traffic exits through DO server, bypassing home ISP.
NFS exports movies and TV to Jellyfin (VM 112).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/systemd/sonarr.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sonarr
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=sonarr
+Group=sonarr
+ExecStart=/opt/Sonarr/Sonarr -nobrowser -data=/var/lib/sonarr
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target