docs: plex and tautulli runtime pages reflect the quadlet migration

- runtime rows: podman quadlet under the systemd user generator, pinned
  image digests, in-place bind mounts, identity model, appnet aliases
- cutover/rollback section on Plex.md (mask-native-unit lever, decommission
  gate); drop the false 'updates are apt-only' and 'snap refresh' gotchas
- update path is now deploy.sh dankserver --service plex|tautulli

serverAppConfigs-docs/Dankserver/Plex.md

@@ -1,42 +1,56 @@
 # Plex
 
-Plex Media Server is the **native (non-container) media server running on
-Dankserver**. It is the only media server actually listening on this host:
-`plexmediaserver.service` is an OS-package systemd unit
-(`/usr/lib/systemd/system/plexmediaserver.service`), enabled and
-running — verified live 2026-08-29. Jellyfin, by contrast, is a research
+Plex Media Server is the **containerized media server on Dankserver**: a
+podman quadlet (`plex.service`) under the systemd **user** generator,
+generated from `dankserver/plex/quadlet/plex.container`. It is the only media
+server actually listening on this host. Jellyfin, by contrast, is a research
 brief on this host, not a running service (see [[Jellyfin]]).
 
 **Host:** Dankserver — **Ports:** 32400/tcp (PMS web + API), 32400 is the
 only port PMS needs for client streaming; LAN clients connect directly,
 public traffic can be fronted by Caddy like every other vhost.
 
-## Facts (live-verified 2026-08-29)
+## Facts
 
 | Item | Value |
 |------|-------|
-| Runtime | native systemd service (`plexmediaserver.service`), **not** a podman quadlet |
-| State | enabled + running (up since 2026-08-21) |
-| Port | `32400/tcp` on `0.0.0.0` |
-| Updates | OS package manager (`apt`) — **not** `scripts/deploy.sh`; the deploy flow never touches this service |
-| GPU | RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier) |
+| Runtime | podman quadlet, `plex.service` (user manager) — migrated from the native `plexmediaserver.service` OS-package unit (2026-09) |
+| Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
+| Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes |
+| Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan |
+| Identity | `UsernsMode=host` + `PUID=997 PGID=984` — container writes land owned 997:984, byte-compatible with the former native unit |
+| Port | `32400/tcp` published on `0.0.0.0` — zero client reconfiguration |
+| Network | `dankserver_appnet`, alias `plex`; Tautulli reaches it at `http://plex:32400` |
+| GPU | none by decision — CPU decode only; the RTX 3090 stays dedicated to `frank-default-small` |
+| Deploy | `./scripts/deploy.sh dankserver --service plex` |
 | Docs | https://support.plex.tv |
 
-## Why it is not a quadlet
+## Why in-place bind mounts
 
-Plex ships as a distro package with its own systemd unit and update
-channel; the repo's boot-persistence rule is satisfied by the native unit
-(it is `enabled`, so it survives reboot — verify with
-`systemctl is-enabled plexmediaserver`). Converting it to a container later
-is a migration, not a config edit: the PMS database (`/var/lib/plexmediaserver`)
-and its claim-token identity would move with it.
+The migration moved zero bytes: the container bind-mounts the native data
+root where it already lived, and the media archive re-mounts at
+`/mnt/entropy` inside the container, so every absolute library path in the
+PMS database keeps resolving. `UsernsMode=host` + `PUID=997/PGID=984` makes
+the container's file identity indistinguishable from the old service's —
+no chown, no re-scan. Rollback is byte-safe at any time before decommission.
+
+## Cutover & rollback
+
+- First deploy stops and **masks** `plexmediaserver.service` (never
+  `disable` — on these hosts `disable` deletes the unit file), then starts
+  the quadlet; the deployer blocks until `/identity` answers on 32400.
+- Rollback lever while masked: `systemctl --user stop plex.service && sudo
+  systemctl unmask plexmediaserver.service && sudo systemctl start
+  plexmediaserver.service`.
+- Decommission (`sudo apt-get -y purge plexmediaserver`) only after explicit
+  operator sign-off.
 
 ## Integration points
 
 - **Caddy:** Plex is exempt from the Anubis bot challenge
   (plain-HTTP legacy clients cannot solve JS challenges) — see
   [[Anubis]] "Exempt by construction".
-- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on `:32400`
+- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on the appnet
   for statistics and notifications and makes no sense without Plex.
 - **Auth wall:** if a public vhost is ever pointed at Plex, put the
   Authentik outpost + Anubis chain in front of it like every other guarded
@@ -45,10 +59,12 @@ and its claim-token identity would move with it.
 
 ## Gotchas
 
-1. **Do not benchmark on it blind.** PMS transcodes contend with the LLM
-   fleet for the same GPU; stop the service (or pin it to CPU
-   transcoding) before benchmark runs, per the Benchmarking Policy.
-2. **Updates are OS-level** — `apt`/`aptly`, not `deploy.sh`; a deploy
-   plan that names `plex` is a bug in the plan.
+1. **Do not benchmark on it blind.** Transcoding is CPU-only now but still
+   contends with the LLM fleet's host-RAM expert streaming; stop the service
+   before benchmark runs, per the Benchmarking Policy.
+2. **Updates are commit-driven, not apt.** The OS package is retired at
+   cutover; upgrading PMS means pinning a new `-ls` tag in the unit file and
+   redeploying — never run `:latest`.
 3. The claim token is the identity of this server; document it in the host
-   `.env`, never in this repo (secret rules apply).
+   `.env`, never in this repo (secret rules apply). The token lives in
+   `Preferences.xml` inside the RW data bind, preserved by the migration.