tautulli healthcheck via curl; restore PublishPort; plex gate to 600s

- tautulli.container: HealthCmd switches to the repo's proven curl pattern
  (jellyfin unit) — quadlet's systemd-style value parsing mangles embedded
  double quotes; PublishPort=8181:8181 restored (a mis-aimed line edit
  replaced it; the PublishPort seam test caught the regression)
- deploy_plex readiness gate: 36x5s -> 120x5s; the 2026-09 cutover showed
  the first container boot of a years-old library runs ~10 min while PMS
  pre-binds 32400 and empty-replies; 180s failed the gate twice with a
  healthy, still-booting service

scripts/deploy-remote.sh

@@ -683,13 +683,16 @@ deploy_plex() {
         run_privileged chown -R 1000:1000 /var/lib/plexmediaserver
     fi
     systemctl --user restart plex.service
-    # Readiness gate: /identity answers MediaContainer XML once PMS is up;
-    # fail the deploy (pending state preserved) rather than mark it deployed blind.
-    for ((i = 1; i <= 36; i++)); do
+    # Readiness gate: /identity answers MediaContainer XML once PMS is up.
+    # Reality check from the 2026-09 cutover: the FIRST container boot of a
+    # years-old library ran ~10 min (PMS pre-binds 32400 during boot and
+    # empty-replies until the HTTP layer is ready), so the gate allows 600s.
+    # Fail the deploy (pending state preserved) rather than mark it deployed blind.
+    for ((i = 1; i <= 120; i++)); do
         curl -fsS --max-time 3 http://127.0.0.1:32400/identity >/dev/null && return 0
         sleep 5
     done
-    echo "FAIL: plex did not answer /identity within 180s" >&2
+    echo "FAIL: plex did not answer /identity within 600s" >&2
     return 1
 }