stacks: add .env + .env.secrets.ctmpl for media stacks

Adds real Vault Agent secret templates and non-secret env vars for
all 15 media stacks. Sanitized real leaks found in the source data:
kodi's real username and real hostnames+IPs in KODI_INSTANCES,
tdarr's real IP and hostname reference, immich's real username -
replaced with generic values (IPs use the RFC 5737 documentation
range, 192.0.2.0/24, rather than another real-looking address).

Every var cross-checked against what its actual public compose file
references before writing, learned from the platform batch.

stacks/media/audiobookshelf/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=13248
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000

stacks/media/bazarr/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=6767
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+UMASK=022

stacks/media/beets/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=8164
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000

stacks/media/calibre-web-automated/.env

@@ -0,0 +1,5 @@
+# Exposed HTTP port
+HTTP_PORT=5297
+
+# System time zone
+TZ=Etc/UTC

stacks/media/calibre/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=8277
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000

stacks/media/immich/.env

@@ -0,0 +1,16 @@
+# Exposed HTTP port
+HTTP_PORT=3466
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+# The Immich version to use. You can pin this to a specific version like "v1.71.0"
+IMMICH_VERSION=v2.7.5
+
+# Postgres
+DB_DATABASE_NAME=immich
+DB_USERNAME=immich

stacks/media/immich/.env.secrets.ctmpl

@@ -0,0 +1 @@
+DB_PASSWORD={{ with secret "kv/host/immich" }}{{ .Data.data.db_password }}{{ end }}

stacks/media/jellyfin/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=8069
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000

stacks/media/kodi/.env

@@ -0,0 +1,20 @@
+# Exposed HTTP port
+HTTP_PORT=3306
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+# User Creds
+MYSQL_USER=kodi
+
+# kodi-ma-bridge
+MA_BASE_URL=http://music-assistant:8095
+KODI_USER=user
+KODI_INSTANCES=host1:192.0.2.10:8115,host2:192.0.2.11:8115
+POLL_INTERVAL_SECONDS=240
+REFILL_THRESHOLD=5
+REFILL_COUNT=10

stacks/media/kodi/.env.secrets.ctmpl

@@ -0,0 +1,4 @@
+MYSQL_ROOT_PASSWORD={{ with secret "kv/host/kodi-mariadb" }}{{ .Data.data.mysql_root_password }}{{ end }}
+MYSQL_PASSWORD={{ with secret "kv/host/kodi-mariadb" }}{{ .Data.data.mysql_password }}{{ end }}
+KODI_PASSWORD={{ with secret "kv/host/kodi-bridge" }}{{ .Data.data.kodi_password }}{{ end }}
+MA_API_TOKEN={{ with secret "kv/host/kodi-bridge" }}{{ .Data.data.ma_api_token }}{{ end }}

stacks/media/lidarr/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=8057
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+UMASK=022

stacks/media/music-assistant/.env

@@ -0,0 +1,6 @@
+# Exposed ports
+PORT1=8095
+PORT2=3483
+PORT3=5353
+PORT4=21064
+PORT5=21064

stacks/media/radarr/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=7482
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+UMASK=022

stacks/media/seerr/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=5395
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000

stacks/media/sonarr/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=8361
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+UMASK=022

stacks/media/tdarr/.env

@@ -0,0 +1,20 @@
+# Exposed HTTP ports
+HTTP_PORT=8265      #webUI
+HTTP_PORT1=8266     #server
+HTTP_PORT2=8267     #Internal_node
+HTTP_PORT3=8268     #node
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+UMASK=022
+
+# Environment
+serverIP=192.0.2.10
+serverPort=8266
+webUIPort=8265
+internalNode=true
+nodeName=internal-node

stacks/media/tinymediamanager/.env

@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=4924
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000