[ci skip] Flatten module wrappers into stack roots

Remove the module "xxx" { source = "./module" } indirection layer
from all 66 service stacks. Resources are now defined directly in
each stack's main.tf instead of through a wrapper module.

- Merge module/main.tf contents into stack main.tf
- Apply variable replacements (var.tier -> local.tiers.X, renamed vars)
- Fix shared module paths (one fewer ../ at each level)
- Move extra files/dirs (factory/, chart_values, subdirs) to stack root
- Update state files to strip module.<name>. prefix
- Update CLAUDE.md to reflect flat structure

Verified: terragrunt plan shows 0 add, 0 destroy across all stacks.

stacks/servarr/aiostreams/main.tf

@@ -95,7 +95,7 @@ resource "kubernetes_service" "aiostreams" {
 }
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = kubernetes_namespace.aiostreams.metadata[0].name
   name            = "aiostreams"
   tls_secret_name = var.tls_secret_name

stacks/servarr/flaresolverr/main.tf

@@ -62,7 +62,7 @@ resource "kubernetes_service" "flaresolverr" {
 }
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "flaresolverr"
   tls_secret_name = var.tls_secret_name

stacks/servarr/lidarr/main.tf

@@ -143,7 +143,7 @@ resource "kubernetes_service" "deemix" {
 
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "lidarr"
   tls_secret_name = var.tls_secret_name
@@ -155,7 +155,7 @@ module "ingress" {
 }
 
 module "ingress-deemix" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "deemix"
   tls_secret_name = var.tls_secret_name

stacks/servarr/listenarr/main.tf

@@ -82,7 +82,7 @@ resource "kubernetes_service" "listenarr" {
 
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "listenarr"
   tls_secret_name = var.tls_secret_name

stacks/servarr/main.tf

@@ -11,9 +11,67 @@ locals {
   }
 }
 
-module "servarr" {
-  source = "./module"
-  tls_secret_name                = var.tls_secret_name
-  tier                           = local.tiers.aux
-  aiostreams_database_connection_string = var.aiostreams_database_connection_string
+resource "kubernetes_namespace" "servarr" {
+  metadata {
+    name = "servarr"
+    labels = {
+      tier = local.tiers.aux
+    }
+  }
+}
+
+module "tls_secret" {
+  source          = "../../modules/kubernetes/setup_tls_secret"
+  namespace       = kubernetes_namespace.servarr.metadata[0].name
+  tls_secret_name = var.tls_secret_name
+}
+
+
+# module "readarr" {
+#   source          = "./readarr"
+#   tls_secret_name = var.tls_secret_name
+#   tier = local.tiers.aux
+# }
+
+module "prowlarr" {
+  source          = "./prowlarr"
+  tls_secret_name = var.tls_secret_name
+  tier            = local.tiers.aux
+}
+
+module "qbittorrent" {
+  source          = "./qbittorrent"
+  tls_secret_name = var.tls_secret_name
+  tier            = local.tiers.aux
+}
+
+module "flaresolverr" {
+  source          = "./flaresolverr"
+  tls_secret_name = var.tls_secret_name
+  tier            = local.tiers.aux
+}
+
+# module "lidarr" {
+#   source          = "./lidarr"
+#   tls_secret_name = var.tls_secret_name
+# tier            = local.tiers.aux
+# }
+
+# module "soulseek" {
+#   source          = "./soulseek"
+#   tls_secret_name = var.tls_secret_name
+# tier            = local.tiers.aux
+# }
+
+module "listenarr" {
+  source          = "./listenarr"
+  tls_secret_name = var.tls_secret_name
+  tier            = local.tiers.aux
+}
+
+module "aiostreams" {
+  source                                = "./aiostreams"
+  tls_secret_name                       = var.tls_secret_name
+  aiostreams_database_connection_string = var.aiostreams_database_connection_string
+  tier                                  = local.tiers.aux
 }

stacks/servarr/module/main.tf

@@ -1,68 +0,0 @@
-variable "tls_secret_name" {}
-variable "tier" { type = string }
-variable "aiostreams_database_connection_string" { type = string }
-
-resource "kubernetes_namespace" "servarr" {
-  metadata {
-    name = "servarr"
-    labels = {
-      tier = var.tier
-    }
-  }
-}
-
-module "tls_secret" {
-  source          = "../../../modules/kubernetes/setup_tls_secret"
-  namespace       = kubernetes_namespace.servarr.metadata[0].name
-  tls_secret_name = var.tls_secret_name
-}
-
-
-# module "readarr" {
-#   source          = "./readarr"
-#   tls_secret_name = var.tls_secret_name
-#   tier = var.tier
-# }
-
-module "prowlarr" {
-  source          = "./prowlarr"
-  tls_secret_name = var.tls_secret_name
-  tier            = var.tier
-}
-
-module "qbittorrent" {
-  source          = "./qbittorrent"
-  tls_secret_name = var.tls_secret_name
-  tier            = var.tier
-}
-
-module "flaresolverr" {
-  source          = "./flaresolverr"
-  tls_secret_name = var.tls_secret_name
-  tier            = var.tier
-}
-
-# module "lidarr" {
-#   source          = "./lidarr"
-#   tls_secret_name = var.tls_secret_name
-# tier            = var.tier
-# }
-
-# module "soulseek" {
-#   source          = "./soulseek"
-#   tls_secret_name = var.tls_secret_name
-# tier            = var.tier
-# }
-
-module "listenarr" {
-  source          = "./listenarr"
-  tls_secret_name = var.tls_secret_name
-  tier            = var.tier
-}
-
-module "aiostreams" {
-  source                                = "./aiostreams"
-  tls_secret_name                       = var.tls_secret_name
-  aiostreams_database_connection_string = var.aiostreams_database_connection_string
-  tier                                  = var.tier
-}

stacks/servarr/prowlarr/main.tf

@@ -102,7 +102,7 @@ resource "kubernetes_service" "prowlarr" {
 
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "prowlarr"
   tls_secret_name = var.tls_secret_name

stacks/servarr/qbittorrent/main.tf

@@ -135,7 +135,7 @@ resource "kubernetes_service" "qbittorrent-torrenting" {
 
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "qbittorrent"
   tls_secret_name = var.tls_secret_name

stacks/servarr/readarr/main.tf

@@ -11,7 +11,7 @@ resource "kubernetes_namespace" "readarr" {
 
 
 module "tls_secret" {
-  source          = "../../../../modules/kubernetes/setup_tls_secret"
+  source          = "../../../modules/kubernetes/setup_tls_secret"
   namespace       = "readarr"
   tls_secret_name = var.tls_secret_name
 }
@@ -119,7 +119,7 @@ resource "kubernetes_service" "readarr" {
 }
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "readarr"
   name            = "readarr"
   port            = 8787

stacks/servarr/soulseek/main.tf

@@ -97,7 +97,7 @@ resource "kubernetes_service" "soulseek" {
 
 
 module "ingress" {
-  source          = "../../../../modules/kubernetes/ingress_factory"
+  source          = "../../../modules/kubernetes/ingress_factory"
   namespace       = "servarr"
   name            = "soulseek"
   tls_secret_name = var.tls_secret_name