stacks: add .env + .env.secrets.ctmpl for media stacks

Adds real Vault Agent secret templates and non-secret env vars for
all 15 media stacks. Sanitized real leaks found in the source data:
kodi's real username and real hostnames+IPs in KODI_INSTANCES,
tdarr's real IP and hostname reference, immich's real username -
replaced with generic values (IPs use the RFC 5737 documentation
range, 192.0.2.0/24, rather than another real-looking address).

Every var cross-checked against what its actual public compose file
references before writing, learned from the platform batch.

stacks/media/immich/.env

@@ -0,0 +1,16 @@
+# Exposed HTTP port
+HTTP_PORT=3466
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+# The Immich version to use. You can pin this to a specific version like "v1.71.0"
+IMMICH_VERSION=v2.7.5
+
+# Postgres
+DB_DATABASE_NAME=immich
+DB_USERNAME=immich

stacks/media/immich/.env.secrets.ctmpl

@@ -0,0 +1 @@
+DB_PASSWORD={{ with secret "kv/host/immich" }}{{ .Data.data.db_password }}{{ end }}