feat: add media-core first migration group

servers/media-core/media-core/README.md

@@ -0,0 +1,16 @@
+# media-core
+
+Arcane-managed media automation services on `media-core` (`192.168.50.46`).
+
+This first migration group contains NZBHydra2, Lidarr, and Whisparr. Download
+clients remain on unRaid; Lidarr and Whisparr use the unRaid SABnzbd instance.
+
+Host prerequisites:
+
+- `/mnt/truenas/multimedia` mounted read-write from TrueNAS.
+- `/mnt/unraid/downloads` mounted read-write from unRaid
+  `/mnt/user/downloads` before Lidarr or Whisparr is enabled.
+- Application data restored under `/opt/media-core/appdata/<service>`.
+
+The image digests match the source containers on `192.168.50.10` at the
+2026-09-05 migration snapshot. Upgrade only after migration acceptance.

servers/media-core/media-core/compose.yaml

@@ -0,0 +1,67 @@
+services:
+  nzbhydra2:
+    image: lscr.io/linuxserver/nzbhydra2:latest@sha256:79798f72d2ac2e02aa38fa20379bc8af4c0cc7d5ec56b7a5c90b9382b81f1b4c
+    container_name: nzbhydra2
+    restart: unless-stopped
+    environment:
+      PUID: "1000"
+      PGID: "1000"
+      TZ: Asia/Shanghai
+    ports:
+      - "5076:5076"
+    volumes:
+      - /opt/media-core/appdata/nzbhydra2:/config
+    networks:
+      - media-core
+    security_opt:
+      - no-new-privileges:true
+    logging: &default-logging
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
+
+  lidarr:
+    image: lscr.io/linuxserver/lidarr:latest@sha256:f2a186ce04ec5adb133f92a08dd3efbc918fc71b33077426ef099d94350dfa1b
+    container_name: lidarr
+    restart: unless-stopped
+    environment:
+      PUID: "65534"
+      PGID: "65534"
+      TZ: Asia/Shanghai
+    ports:
+      - "8686:8686"
+    volumes:
+      - /opt/media-core/appdata/lidarr:/config
+      - /mnt/truenas/multimedia:/mnt/truenas/multimedia
+      - /mnt/unraid/downloads:/mnt/unRaid/downloads
+    networks:
+      - media-core
+    security_opt:
+      - no-new-privileges:true
+    logging: *default-logging
+
+  whisparr:
+    image: ghcr.io/hotio/whisparr:latest@sha256:cb6f32312e39a8574a1dc13174fa2165335828c8722f19f66c27a8ae292800b9
+    container_name: whisparr
+    restart: unless-stopped
+    environment:
+      PUID: "1000"
+      PGID: "1000"
+      UMASK: "002"
+      TZ: Asia/Shanghai
+    ports:
+      - "6969:6969"
+    volumes:
+      - /opt/media-core/appdata/whisparr:/config
+      - /mnt/truenas/multimedia:/mnt/truenas/multimedia
+      - /mnt/unraid/downloads:/mnt/unRaid/downloads
+    networks:
+      - media-core
+    security_opt:
+      - no-new-privileges:true
+    logging: *default-logging
+
+networks:
+  media-core:
+    name: media-core