plex: its state is placed, not written over ace's disk

The manifest named /services/plex/{config,transcode} with owner and mode.
On ace /services/plex is a link to /mnt/plex, plex's 133 GB of state, so
a take would have chmod'ed 0700 the top of the one directory the operator
ruled must never be re-moded or re-owned. The directories are now pathless
(config, data, transcode), placed by the mesh; on an adopted machine they
must be placed where the data is (hq 153) before plex is ever taken.

- The container sees exactly the paths ace's plex sees today: /config,
  /data (HAL mounts it; the catalogue did not), /transcode and all eight
  libraries, including sport-games, live-shows and formula-1. A library
  whose mount disappears is emptied by Plex's automatic trash emptying,
  taking its watch state with it.
- Libraries are mounted read-only, as the accesses already said.
- Owner 1000:1000 and mode 0755: plex runs as uid 1000 (the image reads
  PLEX_UID, not the PUID HAL passes), pms-docker leaves its dirs 0755, and
  ace's /mnt/plex is 1000:1000 0755 - so placing adopted data is a no-op.
- Image pinned to what ace runs, 1.43.4.10903; the old pin was 1.43.3.
- ADVERTISE_IP comes from the route's own public name through an env-file
  (${bound:route:name}); it depends on mesh-controller #149, and without
  it the declaration is refused, not applied.
- The server is routed (label plex) and declares its four GDM discovery
  ports, which LAN players use.
- No token secret: a minted one is not a Plex token and the sidecar
  preferred it. The sidecar reads PlexOnlineToken from Preferences.xml
  through its read-only config mount, and dials ${port:32400}.

Verified: catalogue tests with MESH_CATALOGUE (parse, mounts); a scratch
resolution with ace's assignment on the #149 controller renders
ADVERTISE_IP=https://plex.zurag.be/, both route names and 32400/tcp +
GDM/udp open to anywhere; on main it is refused naming "name". A
throwaway pms-docker at the pinned digest on empty dirs answered
/identity, wrote customConnections from the env-file and ran as 1000;
client.ts typechecks strict and found the token in a Preferences.xml.

modules/plex/client.ts

@@ -58,8 +58,10 @@ export class PlexClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
     const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
     const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
-    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
+    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
+    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
+    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
+    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
     const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
     if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
     return new PlexClient(url, token);