fix(media): resolve arr stack deployment failures

- prowlarr: remove serviceFilePerms (DynamicUser has no static user)
- sonarr/radarr: move media dir creation to system-level tmpfiles rules
  to avoid unsafe path transition from /torrents (qbittorrent:media)
- jellyseerr: override DynamicUser=false, create static user/group,
  use serviceFilePerms for ZFS-backed configDir permissions

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

services/prowlarr.nix

@@ -10,9 +10,6 @@
     (lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [
       service_configs.prowlarr.dataDir
     ])
-    (lib.serviceFilePerms "prowlarr" [
-      "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
-    ])
     (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
   ];