userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

Move every shared-media + ingest mount off ${HDD_PATH}/media onto the new
${USERDATA_PATH}/... convention (controller injects USERDATA_PATH = <namespace>/userdata):
- jellyfin/emby/plex: media:/media:ro ; navidrome: media/music:ro
- audiobookshelf (user 1000:1000): media/{audiobooks,podcasts}
- komga (user 1000:1000): media/comics
- calibre-web (UMASK=002): library->media/books, ingest->import/calibre
- radarr/sonarr (UMASK=002): media/{movies,tv} + downloads (sibling, same FS)
- romm: ROM library -> userdata/roms (browsable); resources stay in appdata
- immich: + external library media/photos:/external/photos:ro (registration is a
  post-deploy admin step — flagged in compose + .felhom.yml)
- paperless: consume -> import/paperless (USERMAP 1000)
- nextcloud: unchanged (fully app-managed)
.felhom.yml first_steps updated for the new browsable drop-zones.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/sonarr/docker-compose.yml

@@ -5,7 +5,12 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Médiatár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Sorozattár → ${USERDATA_PATH}/media/tv     (írható)
+#   Letöltések → ${USERDATA_PATH}/downloads    (SIBLING of media — same FS → hardlink/atomic move)
+# Run-identity: PUID/PGID 1000 (shared content group); UMASK=002 → group-writable output.
 
 services:
   sonarr:
@@ -16,10 +21,11 @@ services:
       - TZ=Europe/Budapest
       - PUID=1000
       - PGID=1000
+      - UMASK=002
     volumes:
       - sonarr_config:/config
-      - ${HDD_PATH}/media:/media
-      - ${HDD_PATH}/downloads:/downloads
+      - ${USERDATA_PATH}/media/tv:/media/tv
+      - ${USERDATA_PATH}/downloads:/downloads
     networks:
       - traefik-public
     deploy: