deployer: route plex and tautulli as dankserver quadlet services

- deploy_plex(): install unit, stop+mask native plexmediaserver.service on
  first cutover (mask, never disable), gate on /identity for 180s
- deploy_tautulli(): install unit, stop+disable snap on first cutover,
  seed config.ini with PMS_Web_Host=plex only if absent
- allow-lists (deploy.sh valid_service, deploy-remote.sh service_is_allowed),
  planner routing (SERVICE_ORDER, DANKSERVER_SERVICES, quadlet_services),
  test-changed cutover case, quadlet seam enumeration + new
  userns/PUID=997/PGID=984 ownership-contract test

scripts/deploy-plan.py

@@ -50,6 +50,8 @@ SERVICE_ORDER = (
     "copyparty",
     "jellyfin",
     "calibre-web",
+    "plex",
+    "tautulli",
     "prowlarr",
     "qbittorrent",
     "radarr",
@@ -99,6 +101,8 @@ DANKSERVER_SERVICES = {
     "copyparty",
     "jellyfin",
     "calibre-web",
+    "plex",
+    "tautulli",
     "prowlarr",
     "qbittorrent",
     "radarr",
@@ -329,6 +333,8 @@ def services_for_path(path: str, target: str) -> set[str]:
                 "jellyfin": {"jellyfin"},
                 "calibre-web": {"calibre-web"},
                 "copyparty": {"copyparty"},
+                "plex": {"plex"},
+                "tautulli": {"tautulli"},
             }
             _add(services, *quadlet_services.get(parts[1], set()))
         return services