added gluetun with qBittorrent and pyload-ng

VPN kill switch via shared network namespace, TorGuard WireGuard through
gluetun's custom provider. compose.yaml is the maintained version;
compose.personal.yaml is the variant actually running, kept as-is.

Verified against gluetun's own settings summary: SOCKSPROXY/SOCKSPROXY_PORT
are not real variables and the SOCKS5 server never starts; HTTPPROXY_PORT is
deprecated; pyload-ng listens on 8000, not 8880.

.gitignore: ignore wg*.conf and *.ovpn everywhere, because add gluetun/compose.yaml gluetun/compose.personal.yaml gluetun/.env.example gluetun/README.md .gitignore/init/** would
otherwise commit a WireGuard private key dropped in a service's init/ dir.
Un-ignore compose.personal.yaml narrowly, so compose.override.yaml stays out.

gluetun/.env.example

@@ -0,0 +1,38 @@
+# Copy to .env and adjust. .env is git-ignored; this file is not.
+#
+# Only TEMPDISK is required -- everything else has a default in
+# compose.yaml. (compose.personal.yaml has no defaults at all: it uses
+# bare ${PUID} etc., which Compose turns into empty strings rather than
+# failing, so with that file set all four.)
+
+# ─── Identity ───────────────────────────────────────────────────────
+# Owner of the downloads directory and the two config directories.
+#   id -u ; id -g
+#PUID=1000
+#PGID=1000
+#TZ=Europe/Paris
+
+# ─── Where downloads land ───────────────────────────────────────────
+# The parent of downloads/torrents and downloads/pyload. Point this at
+# the disk with room on it -- this is the one path that cannot have a
+# sensible default.
+TEMPDISK=/mnt/tank
+
+# ─── Proxy authentication ───────────────────────────────────────────
+# Both proxies are UNAUTHENTICATED unless these are set -- anyone who can
+# reach ports 9980/9998 can route traffic through your VPN account. Set
+# both (gluetun needs user and password together) and authentication turns
+# on for the HTTP and SOCKS5 proxies at once.
+#PROXY_USER=
+#PROXY_PASSWORD=
+
+# ─── Ports ──────────────────────────────────────────────────────────
+#QBT_PORT=9880
+#PYLOAD_PORT=8880
+#SOCKS_PORT=9980
+#HTTPPROXY_PORT=9998
+
+# ─── NOT in this file ───────────────────────────────────────────────
+# Your WireGuard credentials do NOT belong here. They live in wg0.conf
+# next to compose.yaml, which is git-ignored (see the README). Do not
+# move that file into init/ and do not paste its keys into .env.