fix(qbittorrent): persist VueTorrent mod cache

[MrStarktastic]

Both qBittorrent instances lost VueTorrent after restarting while GHCR was unreachable. The mod installer skipped installation because its ephemeral /modcache was empty, leaving /vuetorrent missing.

Mount /modcache from a modcache subdirectory on each instance's existing config PVC. The shared qBittorrent values cover both instances through baseApp inheritance, preserve /config, and require no additional PVCs. After one successful download, the installer can reuse the cached mod during a registry outage.

Validation:

• Pre-commit checks and YAML lint passed.
• Rendered app-template 5.2.1 with the actual globals/common/base/variant value layers for both instances.
• Compared rendered resources: only the /modcache mounts changed; PVCs, existing mounts, and all other settings are preserved.
• Independent review found no actionable issues.

Deployment: once ArgoCD's RollingSync reconciles the merge, the pod-template changes will replace both pods. The RU instance may wait for normal reconciliation because the push workflow directly refreshes only the changed base app. The first startup still needs GHCR access to populate the cache. Alternative WebUI is currently disabled in both instances and must be re-enabled at /vuetorrent after installation. No live workload changes were made for this PR.

[github-actions]

Static Validation

✅ YAML Lint: Passed
✅ Kubeconform: Passed

Summary

./infrastructure/system/crowdsec/manifests/prometheus-rules.yaml - PrometheusRule crowdsec-alerts is valid
./infrastructure/controllers/authentik/manifests/ldap-outpost-service.yaml - Service ak-outpost-ldap-outpost is valid
./infrastructure/controllers/authentik/manifests/ldap-outpost-deployment.yaml - Deployment ak-outpost-ldap-outpost is valid
./infrastructure/system/intel-device-operator/manifests/gpu-device-plugin.yaml - intel-gpu GpuDevicePlugin skipped
Summary: 85 resources found in 78 files - Valid: 84, Invalid: 0, Errors: 0, Skipped: 1

✅ Homepage Coverage: Passed
✅ Alert Policy: Passed

---

Argo CD Diff Preview

Summary:

Modified (1):
± qbittorrent (+6)

qbittorrent (bootstrap/appsets/cluster-apps.yaml)

Deployment: media/qbittorrent

             port: 8080
           timeoutSeconds: 1
         volumeMounts:
         - mountPath: /config
           name: config
+        - mountPath: /modcache
+          name: config
+          subPath: modcache
         - mountPath: /downloads/incomplete
           name: incomplete
           subPath: qbittorrent
         - mountPath: /data
           name: media
@@ skipped 11 lines (79 -> 89) @@
         image: busybox:stable
         name: clean-stale-locks
         volumeMounts:
         - mountPath: /config
           name: config
+        - mountPath: /modcache
+          name: config
+          subPath: modcache
         - mountPath: /data
           name: media
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
       securityContext:

Stats:
[Applications: 2], [Full Run: 1m1s], [Rendering: 2s], [Cluster: 22s], [Argo CD: 36s]