Add watchtower monitor-only labels to gluetun/qbittorrent (fixes network orphan bug)

jellyfin/qbittorrent/docker-compose.yml

@@ -1,67 +0,0 @@
-services:
-  gluetun:
-    image: qmcgaw/gluetun:latest
-    container_name: gluetun
-    cap_add:
-      - NET_ADMIN
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    environment:
-      - VPN_SERVICE_PROVIDER=protonvpn
-      - VPN_TYPE=openvpn
-      - OPENVPN_USER=${OPENVPN_USER}
-      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
-      - FIREWALL_OUTBOUND_SUBNETS=192.168.88.0/24
-      - FIREWALL_INPUT_PORTS=8080
-      - TZ=America/Chicago
-    ports:
-      - 8080:8080
-      - 6881:6881
-      - 6881:6881/udp
-    volumes:
-      - /srv/docker/gluetun:/gluetun
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "sh", "-c", "wget -qO- https://ipinfo.io/ip || exit 1"]
-      interval: 60s
-      timeout: 20s
-      retries: 3
-      start_period: 30s
-
-  qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:latest
-    container_name: qbittorrent
-    network_mode: "service:gluetun"
-    depends_on:
-      gluetun:
-        condition: service_healthy
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Chicago
-      - WEBUI_PORT=8080
-    volumes:
-      - /srv/docker/qbittorrent/config:/config
-      - /mnt/media:/mnt/media
-    restart: unless-stopped
-
-# NOTE (2026-08-07): Replaces the native qbittorrent-nox systemd service on the
-# jellyfin host, which was bound to a desktop ProtonVPN app's tunnel interface
-# (proton0). When that GUI-managed tunnel dropped, there was no way to reconnect
-# without an interactive desktop session, silently killing all downloads.
-#
-# qbittorrent now runs with network_mode: service:gluetun, so it shares gluetun's
-# network namespace entirely. If the VPN drops, qbittorrent has zero network
-# access (fails closed, never falls back to the real IP) until gluetun
-# auto-reconnects on its own -- no GUI or manual intervention needed.
-#
-# OPENVPN_USER / OPENVPN_PASSWORD are the ProtonVPN OpenVPN/IKEv2 credentials
-# (see API Codes.md), NOT the regular Proton account login. Set them in a .env
-# file alongside this compose file (not committed) or export them before
-# `docker compose up -d`.
-#
-# qbittorrent's media volume is mounted at /mnt/media (matching the original
-# native install), NOT /data, so it lines up with Sonarr/Radarr's existing
-# Remote Path Mapping (host 192.168.88.10: /mnt/media/ -> /data/) and the
-# pre-existing categories (tv-sonarr, movies-radarr) needed zero path rewriting
-# when migrating resume data.