fix(plex): mount config PVC at /config (image's real config dir)

The plexinc/pms-docker image writes its identity/claim token and the
Library metadata DB under /config, but the config PVC was mounted at the
renderer default /data/config. Plex therefore wrote all state to the
container's EPHEMERAL layer: the server stayed UNCLAIMED (servers.plex.tv
returns 401 with an empty X-Plex-Token) and lost everything on restart,
which is why seerr's "add Plex" failed even with SSL off.

Set the config volume mountPath to /config in catalog/plex.yaml and
re-render apps/wave-0/plex.yaml (only the mountPath line changes; all
other services byte-identical). No fsGroup/securityContext needed:
verified in-cluster the image inits as root (s6-svscan PID 1), chowns
/config to the plex user, then drops privileges (the "Plex Media Server"
process runs as plex) — root can chown the mounted PVC regardless of
fsGroup.

PLEX_CLAIM auto-claim is intentionally NOT wired: the env secretKeyRef
schema has no `optional`, so a placeholder/absent claim Secret would
crashloop the pod. The claim is an operator step (UI sign-in after the
roll, or add a PLEX_CLAIM env from a fresh https://plex.tv/claim token).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-0/plex.yaml

@@ -80,7 +80,7 @@ spec:
         - containerPort: 32400
         volumeMounts:
         - name: config
-          mountPath: /data/config
+          mountPath: /config
       volumes:
       - name: config
         persistentVolumeClaim:

catalog/plex.yaml

@@ -29,6 +29,15 @@ storage:
   - name: config
     size: 8Gi
     class: longhorn           # Plex DB/metadata: replicated app state on the 3-replica tier (docs/04; R-STATE-01/02)
+    mountPath: /config        # plexinc/pms-docker writes its identity/claim + "Library" DB under /config, NOT the
+                              # renderer default /data/config. Without this the PVC sat unused and Plex wrote to the
+                              # container's EPHEMERAL layer -> unclaimed + all state lost on restart. The image inits as
+                              # root (s6-svscan PID 1), chowns /config to the plex user, then drops -> no fsGroup needed
+                              # (verified in-cluster: PID1=root, "Plex Media Server"=plex). Persisting /config here also
+                              # makes the claim survive restarts once claimed. To auto-claim on first boot instead of the
+                              # UI sign-in, the operator adds a PLEX_CLAIM env from a fresh https://plex.tv/claim token
+                              # (4-min TTL) — deliberately NOT wired here: the env secretKeyRef pattern has no `optional`,
+                              # so a placeholder/absent claim Secret would crashloop the pod. See operator hand-off.
 dependencies: []              # default-deny: reaches only DNS; clients/Seerr reach IT (docs/03; R-NET-01/02)
 ingressRoutes:
   - host: plex.home.keithjackson.dev