tautulli healthcheck via curl; restore PublishPort; plex gate to 600s

- tautulli.container: HealthCmd switches to the repo's proven curl pattern
  (jellyfin unit) — quadlet's systemd-style value parsing mangles embedded
  double quotes; PublishPort=8181:8181 restored (a mis-aimed line edit
  replaced it; the PublishPort seam test caught the regression)
- deploy_plex readiness gate: 36x5s -> 120x5s; the 2026-09 cutover showed
  the first container boot of a years-old library runs ~10 min while PMS
  pre-binds 32400 and empty-replies; 180s failed the gate twice with a
  healthy, still-booting service

dankserver/tautulli/quadlet/tautulli.container

@@ -11,7 +11,7 @@ Environment=PGID=0
 Environment=TZ=America/Los_Angeles
 Volume=/home/dank/Containers/tautulli:/config
 PublishPort=8181:8181
-HealthCmd=python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8181/home')"
+HealthCmd=curl -fs http://localhost:8181/home
 HealthInterval=30s
 HealthTimeout=10s
 HealthRetries=3

scripts/deploy-remote.sh

@@ -683,13 +683,16 @@ deploy_plex() {
         run_privileged chown -R 1000:1000 /var/lib/plexmediaserver
     fi
     systemctl --user restart plex.service
-    # Readiness gate: /identity answers MediaContainer XML once PMS is up;
+    # Readiness gate: /identity answers MediaContainer XML once PMS is up.
-    # fail the deploy (pending state preserved) rather than mark it deployed blind.
+    # Reality check from the 2026-09 cutover: the FIRST container boot of a
-    for ((i = 1; i <= 36; i++)); do
+    # years-old library ran ~10 min (PMS pre-binds 32400 during boot and
+    # empty-replies until the HTTP layer is ready), so the gate allows 600s.
+    # Fail the deploy (pending state preserved) rather than mark it deployed blind.
+    for ((i = 1; i <= 120; i++)); do
         curl -fsS --max-time 3 http://127.0.0.1:32400/identity >/dev/null && return 0
         sleep 5
     done
-    echo "FAIL: plex did not answer /identity within 180s" >&2
+    echo "FAIL: plex did not answer /identity within 600s" >&2
     return 1
 }
 

serverAppConfigs-docs/Dankserver/Plex.md

@@ -71,3 +71,7 @@ root runs as the `dank` user, and the deployer adopts the data root with
 3. The claim token is the identity of this server; document it in the host
    `.env`, never in this repo (secret rules apply). The token lives in
    `Preferences.xml` inside the RW data bind, preserved by the migration.
+4. **Cold container boot is slow.** PMS pre-binds 32400 and empty-replies
+   while the HTTP layer finishes loading; the first boot of a years-old
+   library took ~10 minutes (2026-09 cutover). The deployer gate now allows
+   600 s before failing; later boots are much faster (warm page cache).

serverAppConfigs-docs/Dankserver/Tautulli.md

@@ -20,7 +20,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`).
 | Port | `8181/tcp` published on `0.0.0.0` |
 | Network | `dankserver_appnet`, alias `tautulli` |
 | PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start |
-| Health | in-container `python3` probe of `http://localhost:8181/home`, 30 s interval / 3 retries |
+| Health | in-container `curl -fs http://localhost:8181/home` probe, 30 s interval / 3 retries |
 | Deploy | `./scripts/deploy.sh dankserver --service tautulli` |
 | Docs | https://github.com/Tautulli/Tautulli/wiki |