Add SABnzbd for Usenet NZB search and download

Wire Newshosting/Tweaknews via secrets-driven configure script, NZBgeek
through Prowlarr, and /data/usenet paths for hardlinks with the Arrs.

docker-compose.yml

@@ -4,7 +4,8 @@ name: arr-stack
 # Arr stack
 #   gluetun      WireGuard VPN client + firewall killswitch
 #   qbittorrent  torrent client, lives INSIDE gluetun's network namespace
-#   prowlarr     indexer manager
+#   prowlarr     indexer manager (torrents + NZB/Usenet indexers)
+#   sabnzbd      Usenet NZB download client (Newshosting, Tweaknews, …)
 #   sonarr       TV         radarr    movies       bazarr    subtitles
 #   jellyfin     media server
 #
@@ -80,6 +81,21 @@ services:
       - ${CONFIG_DIR}/qbittorrent:/config
       - ${DATA_DIR}:/data                  # single shared tree -> hardlinks
 
+  # ---------------------------------------------------------- usenet / NZB #
+  # SABnzbd talks to Usenet providers over SSL (no VPN required).
+  # Incomplete + complete under /data/usenet so Sonarr/Radarr can hardlink.
+  sabnzbd:
+    image: lscr.io/linuxserver/sabnzbd:latest
+    container_name: sabnzbd
+    restart: unless-stopped
+    networks: [arr-net]
+    ports:
+      - "${SABNZBD_PORT:-8085}:8080"
+    environment: *arr-env
+    volumes:
+      - ${CONFIG_DIR}/sabnzbd:/config
+      - ${DATA_DIR}:/data
+
   # -------------------------------------------------------------- indexers #
   prowlarr:
     image: lscr.io/linuxserver/prowlarr:latest