docs: plex and tautulli runtime pages reflect the quadlet migration

- runtime rows: podman quadlet under the systemd user generator, pinned
  image digests, in-place bind mounts, identity model, appnet aliases
- cutover/rollback section on Plex.md (mask-native-unit lever, decommission
  gate); drop the false 'updates are apt-only' and 'snap refresh' gotchas
- update path is now deploy.sh dankserver --service plex|tautulli

serverAppConfigs-docs/Dankserver/Tautulli.md

@@ -1,29 +1,34 @@
 # Tautulli
 
 Tautulli is the statistics, monitoring, and notification companion for
-Plex Media Server. On Dankserver it runs as a **snap**
-(`snap.tautulli.tautulli.service`, verified live 2026-08-29) — a third
-runtime style on this host alongside podman quadlets and the native Plex
-unit. It listens on `8181/tcp` on all interfaces.
+Plex Media Server. On Dankserver it runs as a **podman quadlet**
+(`tautulli.service`) under the systemd **user** generator, generated from
+`dankserver/tautulli/quadlet/tautulli.container` — migrated from the snap
+(2026-09; the snap carried zero config, so the cutover was a fresh install).
 
 **Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without
-it; it talks to PMS over `:32400` using the same claim token clients use).
+it; it talks to PMS over the appnet at `http://plex:32400`).
 
-## Facts (live-verified 2026-08-29)
+## Facts
 
 | Item | Value |
 |------|-------|
-| Runtime | snap (`snap.tautulli.tautulli.service`) — not a quadlet, not an OS package |
-| State | running; snaps self-start at boot (no unit to enable) |
-| Port | `8181/tcp` on `0.0.0.0` |
-| Updates | `snap refresh tautulli` — the snap store channel is the update path, not `deploy.sh` |
+| Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
+| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
+| Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
+| Identity | `UsernsMode=host` + `PUID=1000 PGID=1000` |
+| Port | `8181/tcp` published on `0.0.0.0` |
+| Network | `dankserver_appnet`, alias `tautulli` |
+| PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start |
+| Health | in-container `python3` probe of `http://localhost:8181/home`, 30 s interval / 3 retries |
+| Deploy | `./scripts/deploy.sh dankserver --service tautulli` |
 | Docs | https://github.com/Tautulli/Tautulli/wiki |
 
 ## What it buys this fleet
 
 - Concurrent-stream dashboard and history: who is watching what, right now,
-  on which client — the only tool that answers "is the 3090 busy
-  transcoding for someone?" without SSHing in.
+  on which client — the only tool that answers "is the CPU busy transcoding
+  for someone?" without SSHing in.
 - Notifications: library updates, download completions, player watch
   sessions — wire them to whatever notifier the fleet standardizes on
   (Discord/ntfy/Telegram are all one dropdown away).
@@ -37,9 +42,12 @@ it; it talks to PMS over `:32400` using the same claim token clients use).
    anyone on the LAN can read the whole watch history. Fine while LAN-only;
    if a public vhost is ever pointed at it, put the Authentik + Anubis
    chain in front first ([[Authentik]], [[Anubis]]).
-2. **Snap confinement.** Logs live under `/var/snap/tautulli/common`, not
-   the conventional `/config` path quadlet services use — Grafana/Loki
-   log-shipping paths must account for it ([[Loki]], [[Alloy]]).
-3. If Plex is ever containerized or migrated, Tautulli's claim-token
-   handling survives (it stores its own copy) but re-verify the PMS URL
-   and port in its settings immediately after the migration.
+2. **First boot shows the setup wizard** — expected pre-token behavior; the
+   wizard also answers 200 on `/home`, so the health gate stays green before
+   any token exists. Enter the PMS claim token through the web UI after
+   cutover; it is stored inside the config bind, never in this repo.
+3. **Snap-era paths are gone.** Logs and config live under the config bind
+   (`/home/dank/Containers/tautulli/...`), not `/var/snap/tautulli/common` —
+   Grafana/Loki log-shipping paths must account for it ([[Loki]], [[Alloy]]).
+4. **Updates are commit-driven** — pin a new `-ls` tag in the unit file and
+   redeploy; never run `:latest`.