servarr: add configXml option with preStart hook

Adds services.arrInit.<name>.configXml for declaratively ensuring XML
elements exist in a Servarr config.xml before the service starts.

Generates a preStart hook on the main service that runs a Python helper
to patch or create config.xml. Undeclared elements are preserved;
declared elements are written with exact values.

Primary use case: preventing recurring Prowlarr 'not listening on port'
failures when config.xml loses the <Port> element — now guaranteed to
exist before Prowlarr starts.

Hardening:
- Atomic writes (tmp + rename): power loss cannot corrupt config.xml
- Malformed XML recovery: fresh <Config> root instead of blocking boot
- Secure default mode (0600) for new files containing ApiKey
- Preserves existing file mode on rewrite
- Assertion against duplicate serviceName targeting

Tests (10 subtests): creates-from-missing, patches-existing, preserves-
undeclared, corrects-tampered, idempotent, malformed-recovery,
ownership-preserved, not-world-readable.

tests/integration.nix

@@ -27,10 +27,19 @@ pkgs.testers.runNixOSTest {
 
       systemd.services.mock-qbittorrent = mocks.mkMockQbittorrent {
         initialCategories = {
-          tv = { name = "tv"; savePath = "/downloads"; };
-          movies = { name = "movies"; savePath = "/downloads"; };
+          tv = {
+            name = "tv";
+            savePath = "/downloads";
+          };
+          movies = {
+            name = "movies";
+            savePath = "/downloads";
+          };
         };
-        before = [ "sonarr-init.service" "radarr-init.service" ];
+        before = [
+          "sonarr-init.service"
+          "radarr-init.service"
+        ];
       };
 
       systemd.tmpfiles.rules = [