4K quality-first arr stack: radarr-4k + sonarr-4k (Step 1 standup+wiring)

Separate instances (ports 7879/8990) on the shared /mnt/media/data hardlink tree.
Ansible inline-compose (idempotent). Wired: Prowlarr apps+sync, Overseerr native-4K
servers (existing radarr is4k mislabel corrected), separate Plex 4K libraries,
Traefik file-provider routers. Tdarr excludes the 4K roots. Recyclarr = deferred Step 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

arrs-4k/traefik-router.dynamic_conf.yml

@@ -0,0 +1,27 @@
+# File-provider routers for the 4K arr UIs — merged into node01
+# /home/tommy/traefik/dynamic_conf.yml (live) under http.routers and http.services.
+# NOTE: watcher was flaky on restart-era; `docker restart traefik` after edits to be safe.
+
+# --- http.routers: ---
+    radarr-4k:
+      rule: "Host(`radarr-4k.goattw.net`)"
+      entryPoints: ["websecure"]
+      tls: { certResolver: letsencrypt }
+      service: radarr-4k-service
+      middlewares: ["secure-headers@file", "authelia-auth@file", "crowdsec-bouncer@file"]
+    sonarr-4k:
+      rule: "Host(`sonarr-4k.goattw.net`)"
+      entryPoints: ["websecure"]
+      tls: { certResolver: letsencrypt }
+      service: sonarr-4k-service
+      middlewares: ["secure-headers@file", "authelia-auth@file", "crowdsec-bouncer@file"]
+
+# --- http.services: ---
+    radarr-4k-service:
+      loadBalancer:
+        servers: [{ url: "http://192.168.99.183:7879" }]
+        serversTransport: default-transport
+    sonarr-4k-service:
+      loadBalancer:
+        servers: [{ url: "http://192.168.99.183:8990" }]
+        serversTransport: default-transport