Deploy qBittorrent through Proton VPN

docs/network.md

@@ -90,6 +90,9 @@ Cloudflare; internal overrides are served by Technitium where noted.
 | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
 | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) |
 | `prowlarr.ahmza.com` | Prowlarr indexer manager | `prowlarr` | Configured for `letsencrypt-prod`; DNS and the certificate must be verified after the first deployment | [`apps/prowlarr/ingress.yaml`](../apps/prowlarr/ingress.yaml) |
+| `qbittorrent.ahmza.com` | qBittorrent download client (outbound traffic through Proton VPN) | `qbittorrent` | Configured for `letsencrypt-prod`; DNS, certificate, and VPN health must be verified after the first deployment | [`apps/qbittorrent/ingress.yaml`](../apps/qbittorrent/ingress.yaml) |
+| `radarr.ahmza.com` | Radarr movie manager | `radarr` | Yes — `letsencrypt-prod`, certificate Ready; LAN DNS resolves to `10.10.60.12` | [`apps/radarr/ingress.yaml`](../apps/radarr/ingress.yaml) |
+| `sonarr.ahmza.com` | Sonarr TV manager | `sonarr` | Yes — `letsencrypt-prod`, certificate Ready; LAN DNS resolves to `10.10.60.12` | [`apps/sonarr/ingress.yaml`](../apps/sonarr/ingress.yaml) |
 | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |
 
 Add a row here every time you point a new hostname at this cluster (see