Add jellyfin media stack with full service automation

- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr,
  Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough
- configure_services.yml automates download clients, root folders, Prowlarr
  indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup
- Fix TPB Cardigann season search: apibay.org returns 0 for season-level
  queries (e.g. the.boys.s05); patch strips season/ep from tv-search params
  and locks the definition file read-only to survive Prowlarr refreshes
- Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle
  multi-line arrays without overwriting the DHCP section
- Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing,
  firewall rule for Traefik IP to Proxmox web UI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/pihole/defaults/main.yml

@@ -11,7 +11,7 @@ pihole_dns_hosts:
   - { ip: "10.10.1.3",   host: "grafana.homelab" }
   - { ip: "10.10.1.3",   host: "proxmox.homelab" }
   - { ip: "10.10.1.3",   host: "adyrem.duckdns.org" }
-  - { ip: "10.10.1.3",   host: "mtg.homelab" }
+  - { ip: "10.10.1.3",   host: "devbox.homelab" }
   - { ip: "10.10.1.3",   host: "jellyfin.homelab" }
   - { ip: "10.10.1.3",   host: "jellyseerr.homelab" }
   - { ip: "10.10.1.3",   host: "radarr.homelab" }

ansible/roles/pihole/templates/update_hosts.py.j2

@@ -7,15 +7,18 @@ hosts = [
 {% endfor %}
 ]
 
-hosts_str = "[" + ", ".join('"' + h + '"' for h in hosts) + "]"
+hosts_str = "[\n" + "".join('    "' + h + '",\n' for h in hosts) + "  ]"
 
 with open("/etc/pihole/pihole.toml", "r") as f:
     content = f.read()
 
+# Only replace the first hosts= (DNS custom records section, not DHCP leases)
 content = re.sub(
-    r"(?m)^( *hosts\s*=\s*)\[.*\]",
+    r"( *hosts\s*=\s*)\[.*?\]",
     r"\g<1>" + hosts_str,
     content,
+    count=1,
+    flags=re.DOTALL,
 )
 
 with open("/etc/pihole/pihole.toml", "w") as f: