sonarr, radarr: tool runtime container + self-detect API key from config.xml (ADR 0052)

Mirrors plex: a broker-bound runtime that serves the module's tools, discovering
the app's API key from its own config.xml under a read-only config-dir mount, URL
defaulting to the server on the node. Proven in the mesh-lab: assigned-sonarr green
(key detected, tools served under the scoped account, no live Sonarr needed).

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/radarr/module.json

@@ -66,6 +66,22 @@
         "/services/media/movies:/movies",
         "/services/media/downloads:/downloads"
       ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-radarr",
+      "image": "mesh-runtime-radarr@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/radarr/broker:/run/secrets/broker:ro",
+        "/services/radarr/config:/var/lib/radarr/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
+        "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
+      }
     }
   ]
 }