Add jellyfin media stack with full service automation

- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr,
  Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough
- configure_services.yml automates download clients, root folders, Prowlarr
  indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup
- Fix TPB Cardigann season search: apibay.org returns 0 for season-level
  queries (e.g. the.boys.s05); patch strips season/ep from tv-search params
  and locks the definition file read-only to survive Prowlarr refreshes
- Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle
  multi-line arrays without overwriting the DHCP section
- Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing,
  firewall rule for Traefik IP to Proxmox web UI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/traefik/defaults/main.yml

@@ -13,6 +13,10 @@ traefik_services:
     public_host: "adyrem.duckdns.org"
     public_path: "/git"
     strip_prefix: "/git"
+  - name: devbox
+    host: "devbox.homelab"
+    backend: "http://10.10.2.10:4001"
+    public_host: "adyrem.duckdns.org"
   - name: mtg
     host: "mtg.homelab"
     backend: "http://10.10.2.10:3000"

ansible/roles/traefik/tasks/main.yml

@@ -60,6 +60,41 @@
   when: traefik_version not in (traefik_installed_version.stdout | default(''))
   notify: Restart traefik
 
+- name: Create traefik certs directory
+  ansible.builtin.file:
+    path: /etc/traefik/certs
+    state: directory
+    owner: traefik
+    group: traefik
+    mode: "0750"
+
+- name: Copy homelab TLS certificate
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../certs/wildcard.homelab.pem"
+    dest: /etc/traefik/certs/homelab.pem
+    owner: traefik
+    group: traefik
+    mode: "0640"
+  notify: Restart traefik
+
+- name: Copy homelab TLS key
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../certs/wildcard.homelab-key.pem"
+    dest: /etc/traefik/certs/homelab-key.pem
+    owner: traefik
+    group: traefik
+    mode: "0640"
+  notify: Restart traefik
+
+- name: Write Traefik TLS config
+  ansible.builtin.template:
+    src: tls.yml.j2
+    dest: /etc/traefik/conf.d/tls.yml
+    owner: traefik
+    group: traefik
+    mode: "0640"
+  notify: Restart traefik
+
 - name: Write Traefik static config
   ansible.builtin.template:
     src: traefik.yml.j2

ansible/roles/traefik/templates/tls.yml.j2

@@ -0,0 +1,6 @@
+tls:
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /etc/traefik/certs/homelab.pem
+        keyFile: /etc/traefik/certs/homelab-key.pem