qbittorrent: placed config, the build ace runs, a login 5.2 accepts, its ports as announced

The manifest named /services/qbittorrent/config and /var/lib/mesh/qbittorrent/
config.json, host paths ADR 0112 takes out of definitions. The config dir is now
pathless (${dir:config}); the runtime's config and route binding live in a
placed state dir.

The image is pinned to 5.2.3_v2.0.14-ls477, the digest ace runs; the old pin
(ls474) was older than the running build.

The tools could not log in to qBittorrent 5.2: it answers a good login with 204
and no body (not 200 "Ok.") and names its cookie QBT_SID_<port> (not SID). The
client now accepts both shapes and sends the cookie back under the name it was
set. It also read the user as "admin" always; it now reads WebUI\Username from
qBittorrent.conf on the read-only config mount.

qBittorrent refuses a request whose Host header names a port other than the one
it listens on. With the mesh publishing 8080 on another machine port, the tools
and every consumer dialling that port were refused. The WebUI now listens on
8112 (WEBUI_PORT, ace's and HAL's number, and clear of unifi's 8080) and is
published on the same number. The torrent port 6881 tcp+udp was not declared at
all; it is now, long-form, because the client announces it to peers.

sonarr, radarr and lidarr reached it by container name on HAL's shared network.
qbittorrent now provides qbittorrent-api (node scope: a download client must share
the consumer's spool) and serves scheme, port, url-base and username; the
password is the operator-accepted pair credential, as for #156. The web endpoint
is routed (label qbittorrent). The runtime dials ${port:8112}, as #154 does.

Verified: catalogue tests with MESH_CATALOGUE set (not skipped); rendered for ace
with pins and without (8112:8112, 6881:6881, 6881:6881/udp either way); a
throwaway of the pinned image on an ace-shaped conf showed the port-mismatch
refusal, then on a same-number port the compiled client logged in, read the user
from qBittorrent.conf, listed torrents and was refused a wrong password and the
default user; strict typecheck and the Dockerfile build pass.

modules/qbittorrent/module.json

@@ -17,10 +17,24 @@
   "listens": [
     {
       "name": "web",
-      "port": 8080,
+      "port": 8112,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the download client's pages"
+      "why": "the download client's pages, and the WebUI API its consumers and its own tools call; qBittorrent refuses a request whose Host names a port other than the one it listens on, so a caller dialling the machine port gets in only when the machine publishes the same number"
+    },
+    {
+      "name": "peers",
+      "port": 6881,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "incoming BitTorrent peer connections; the client announces this number to trackers and peers, so the machine must publish it on the same one"
+    },
+    {
+      "name": "peers-udp",
+      "port": 6881,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "DHT and uTP on the same number as the peer port; announced like it, so published on the same one"
     }
   ],
   "accesses": [
@@ -36,10 +50,15 @@
       "path": "/var/lib/mesh/qbittorrent",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/qbittorrent/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -47,24 +66,27 @@
       "id": "server",
       "type": "container",
       "name": "qbittorrent",
-      "image": "lscr.io/linuxserver/qbittorrent@sha256:a00b6a597a3832a1814cde0ef60abc55c94644f3f80902c3432f6af6de8d4a96",
+      "image": "lscr.io/linuxserver/qbittorrent@sha256:457e4eec2ee3f5e4ef59f237ad51f6143deba9f7445ab48bb5204a98888ef9aa",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
-        "TZ": "Etc/UTC"
+        "TZ": "Etc/UTC",
+        "WEBUI_PORT": "8112"
       },
       "ports": [
-        "8080"
+        "8112:8112",
+        "6881:6881",
+        "6881:6881/udp"
       ],
       "volumes": [
-        "/services/qbittorrent/config:/config",
+        "${dir:config}:/config",
         "/services/media/downloads:/downloads"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/qbittorrent/config.json",
+      "path": "${dir:state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -77,22 +99,46 @@
       "volumes": [
         "/var/lib/mesh/qbittorrent/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/qbittorrent/password:/run/secrets/password:ro",
-        "/var/lib/mesh/qbittorrent/config.json:/run/config/config.json:ro",
-        "/services/qbittorrent/config:/var/lib/qbittorrent/config:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/qbittorrent/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8112}",
         "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
         "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
         "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"
       },
       "restart-on": [
-        "runtime-config"
+        "runtime-config",
+        "needs-password"
       ],
       "artifact": "runtime"
     }
   ],
+  "provides": [
+    "qbittorrent-api"
+  ],
+  "serves": {
+    "qbittorrent-api": {
+      "scheme": "http",
+      "port": 8112,
+      "url-base": "",
+      "username": "admin"
+    }
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "qbittorrent",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
   "build": {
     "on": [
       {