arr: declare critical config.xml elements via configXml

Pin <Port>, <BindAddress>, and <EnableSsl> in each arr service's
config.xml through arr-init's new configXml option. A preStart hook
ensures these elements exist before the service reads its config,
fixing the recurring Prowlarr bug where <Port> was absent from
config.xml and the service would run without binding any socket.

Updates arr-init lock to 6dde2a3.

services/arr/init.nix

@@ -9,6 +9,14 @@
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
       networkNamespaceService = "wg";
+      # Guarantee critical config.xml elements before startup. Prowlarr has a
+      # history of losing <Port> from config.xml, causing the service to run
+      # without binding any socket. See arr-init's configXml for details.
+      configXml = {
+        Port = service_configs.ports.private.prowlarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       # Synced-app health checks require Sonarr/Radarr to reverse-connect to
       # prowlarrUrl, which is unreachable across the wg namespace boundary.
       healthChecks = false;
@@ -40,6 +48,11 @@
       port = service_configs.ports.private.sonarr.port;
       dataDir = service_configs.sonarr.dataDir;
       healthChecks = true;
+      configXml = {
+        Port = service_configs.ports.private.sonarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       rootFolders = [ service_configs.media.tvDir ];
       naming = {
         renameEpisodes = true;
@@ -72,6 +85,11 @@
       port = service_configs.ports.private.radarr.port;
       dataDir = service_configs.radarr.dataDir;
       healthChecks = true;
+      configXml = {
+        Port = service_configs.ports.private.radarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       rootFolders = [ service_configs.media.moviesDir ];
       naming = {
         renameMovies = true;