docs(plex): the scan recipe kept its own promise about the token

The block said the token rides stdin and never argv, then handed it to curl as
`-H "X-Plex-Token: $T"` — world-readable in /proc/<pid>/cmdline. It now writes
a mode-600 curl config inside the container, which is also how the overnight
rescan was actually issued (five sections, all accepted). Two truths the old
block got wrong are stated: a section answers 200 with a Directory body when
Accept: application/json is sent, and a backslash-newline inside a quoted
printf format is literal, so the config builder writes two printfs.

serverAppConfigs-docs/Dankserver/Plex.md

@@ -102,15 +102,30 @@ rides stdin, never argv, where any process on the host could read it out of
 umask 077
 podman exec plex sh -c "sed -n 's/.*PlexOnlineToken=\"\\([^\"]*\\)\".*/\\1/p' \
   '/config/Library/Application Support/Plex Media Server/Preferences.xml'" >/tmp/px.tok
-podman exec -i plex sh -c 'read -r T
+cat >/tmp/pxscan.sh <<'EOS'
-  for k in $(curl -s -H "X-Plex-Token: $T" -H "Accept: application/json" \
+read -r T
-      http://127.0.0.1:32400/library/sections | grep -o "\"key\":\"[0-9]*\"" | cut -d\" -f4); do
+cfg=$(mktemp)
-    curl -s -o /dev/null -w "plex section $k: %{http_code}\n" -X POST \
+mk() { { printf 'header = "X-Plex-Token: %s"\nheader = "Accept: application/json"\n' "$T"
-      -H "X-Plex-Token: $T" "http://127.0.0.1:32400/library/sections/$k/refresh"
+        printf 'url = "%s"\n' "$1"; } > "$cfg"; }
-  done' </tmp/px.tok
+mk "http://127.0.0.1:32400/library/sections"
+for k in $(curl -s -K "$cfg" | grep -o '"key":"[0-9]*"' | cut -d\" -f4); do
+  mk "http://127.0.0.1:32400/library/sections/$k/refresh"
+  printf 'request = "POST"\n' >> "$cfg"
+  echo "plex section $k: $(curl -s -o /dev/null -w '%{http_code}' -K "$cfg")"
+done
+shred -u "$cfg"
+EOS
+podman cp /tmp/pxscan.sh plex:/tmp/pxscan.sh
+podman exec -i plex sh /tmp/pxscan.sh </tmp/px.tok
+shred -u /tmp/px.tok
 ```
 
-Every section answers `204` on success. Proof that a rename landed is not a scan
+Every section answers `204` — or `200` with a Directory body when
-response — `scripts/media-verify.py` replays the run's journal against the
+`Accept: application/json` is sent. Inside the quoted `printf` format a
-database, which is the only read that distinguishes "not scanned yet" from "gone";
+backslash-newline is LITERAL, not a continuation, so `mk` writes two `printf`s:
-see [[Media Relayout]].
+one glued line and one stray backslash is a config file curl rejects, and the
+failure prints as `option -K: is unknown`, never as a bad config line.
+
+Proof that a rename landed is not a scan response: `scripts/media-verify.py`
+replays the run's journal against the database — the only read that
+distinguishes "not scanned yet" from "gone"; see [[Media Relayout]].