plex: full nox module — client, tools and events (ADR 0044/0046)

Moves plex's API client and tools out of the shared hal sdk into the module,
so a Plex API change rebuilds only plex. Tools: status, search, sessions,
recently-added, refresh. And a real event design: it emits playback
started/stopped and item.added by watching the server, and consumes
module.*.download.completed to rescan so a downloader's fetch becomes a
visible item. Typechecks against the sdk; manifest parses with its emits/
consumes and broker own-secret.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/plex/module.json

@@ -4,6 +4,17 @@
   "capabilities": [
     "container-runtime"
   ],
+  "emits": [
+    "module.plex.playback.started",
+    "module.plex.playback.stopped",
+    "module.plex.item.added"
+  ],
+  "consumes": [
+    "module.*.download.completed"
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/plex/broker"
+  },
   "listens": [
     {
       "port": 32400,