Add jellyfin media stack with full service automation

- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr,
  Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough
- configure_services.yml automates download clients, root folders, Prowlarr
  indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup
- Fix TPB Cardigann season search: apibay.org returns 0 for season-level
  queries (e.g. the.boys.s05); patch strips season/ep from tv-search params
  and locks the definition file read-only to survive Prowlarr refreshes
- Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle
  multi-line arrays without overwriting the DHCP section
- Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing,
  firewall rule for Traefik IP to Proxmox web UI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/proxmox_host/files/pve_firewall.py

@@ -10,6 +10,7 @@ DESIRED = [
     {'proto': 'tcp', 'source': '10.10.10.0/24',  'dport': '2222'},
     {'proto': 'tcp', 'source': '192.168.1.0/24', 'dport': '8006'},
     {'proto': 'tcp', 'source': '10.10.10.0/24',  'dport': '8006'},
+    {'proto': 'tcp', 'source': '10.10.1.3',      'dport': '8006'},
     {'proto': 'tcp', 'source': '192.168.1.0/24', 'dport': '3128'},
     {'proto': 'udp', 'source': '10.10.0.0/16',   'dport': '53'},
     {'proto': 'tcp', 'source': '10.10.0.0/16',   'dport': '53'},