Migrate Plex from ESXi VM to Docker container

Plex ran on a dedicated Debian 11 VM at 10.100.0.24 until that OS reached
LTS EOL on 2026-08-31 and apt security updates started 404ing. It now runs
as a host-networked container on the Docker host at 10.100.0.35.

Adds plex-docker-migration.md: the decision record and the executed
procedure. The two choices worth knowing about are that media is bind
mounted at the paths the library DB already stores (/mnt/nfs/*) so the
migration rewrote none of its 32,262 absolute paths, and that the
container runs on host networking so Plex still sees real client source
IPs and does not throttle LAN playback as remote.

Preferences.xml was carried across, so the server kept machine identifier
7aa65063599874eac3d9a2f62df74c1816400c88 and Tautulli, seerr and existing
clients continued working without reconfiguration. Verified after cutover:
libraries 1959/421/146 and 11,481 history entries, all matching the
pre-migration baseline exactly.

Rewrites plex.md for the container, adds plex to docker.md, and updates
the component list in CLAUDE.md. The old VM is retained powered on with
plexmediaserver stopped and disabled as rollback, so docs for ESXi and
Veeam are deliberately left describing it until decommission.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker.md

@@ -75,6 +75,7 @@ All 21 containers running. Most are on the `traefik` network.
 | prowlarr | lscr.io/linuxserver/prowlarr:latest | prowlarr.dohertylan.com | 9696 | Indexer manager |
 | seerr | ghcr.io/seerr-team/seerr:latest | requests.dohertylan.com | 5055 | Media request UI |
 | profilarr | santiagosayshey/profilarr:latest | profilarr.dohertylan.com | 6868 | Quality profile sync |
+| plex | lscr.io/linuxserver/plex:latest | plex.dohertylan.com | 32400 (host net) | Media server — see [plex.md](plex.md) |
 | tautulli | ghcr.io/tautulli/tautulli:latest | tautulli.dohertylan.com | 8181 | Plex analytics |
 
 ### Downloads
@@ -137,6 +138,7 @@ All compose files are under `/opt/<service>/docker-compose.yml`:
 /opt/tautulli/        /opt/nzbget/          /opt/vpn_downloads/
 /opt/uptime_kuma/     /opt/stash/           /opt/utilities/
 /opt/semaphore/       /opt/ilo_fan/
+/opt/plex/
 /opt/otopcua-mssql/   /opt/otopcua-modbus/  /opt/otopcua-abcip/
 /opt/otopcua-s7/      /opt/otopcua-opcuaclient/
 ```