docs: stage PD DB targets for Serenity migration

docs/planning/SERENITY_CLEANUP_WAVE_1.md

@@ -373,6 +373,19 @@ Definition of done:
 - connection details verified from the future PD app network context
 - migration rollback notes captured before any source export
 
+Execution notes (2026-05-25):
+- staged PD targets on the live shared DB services:
+  - Postgres DB/user: `gamevault` / `gamevault`
+  - MariaDB DB/user: `romm` / `romm`
+- stored live credentials in the PD media stack env file and synced that env into the encrypted secrets repo; credentials were not written into the main repo
+- verified future app-network connectivity with ephemeral clients on `ix-databases_shared-databases`:
+  - Postgres check returned `gamevault|gamevault`
+  - MariaDB check returned `romm` / `romm@%`
+- rollback notes:
+  - pre-change backup of PD media env: `/mnt/docker-ssd/docker/compose/media/.env.pre-serenity-wave2-d2-20260525-182938`
+  - if D3/D4 later uncover an issue, keep the staged DBs unused, restore the prior media `.env` if needed, and rotate/drop the staged users before re-attempting
+  - no Serenity source data was touched yet in D2; this card only prepared empty PD landing zones
+
 ### Card D3 — export and validate Serenity source databases
 Definition of done:
 - pre-cutover exports from Serenity are taken for both apps so restore/import flow can be tested before downtime

media/.env.example

@@ -12,3 +12,13 @@ CWA_PGID=1001
 SEERR_DB_NAME=seerr
 SEERR_DB_USER=seerr
 SEERR_DB_PASS=changeme
+
+# GameVault postgres target on shared-postgres
+GAMEVAULT_DB_NAME=gamevault
+GAMEVAULT_DB_USER=gamevault
+GAMEVAULT_DB_PASS=changeme
+
+# RomM MariaDB target on shared-mariadb
+ROMM_DB_NAME=romm
+ROMM_DB_USER=romm
+ROMM_DB_PASS=changeme