docs(202-e2e): record completed Plex real-server pin-flow validation

Completes the outstanding Plex flow in the #202 post-merge integration
checklist against a disposable test Plex Media Server: pin-flow auth,
server/library discovery (the 2026-07-13 gap that returned servers:[]),
sync-preference persistence, and sign-out cleanup all passed. Records
exact API state evidence and the test-admin credential reset.

fixes #333

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/handoffs/202-manual-e2e-checklist.md

@@ -8,10 +8,10 @@ The original live local E2E run (branch `feat/202-media-sources`, worktree
 `/Users/timothy/etv-worktrees/202-int`) automated everything that a disposable local instance could
 exercise (local library CRUD, scan, move-path, delete, dirty-guard, apiKey contract, remote-screen
 render). The two flows below genuinely need a live Jellyfin/Emby server and a live Plex account.
-Results from the first homelab run on 2026-07-13 are recorded under each flow. Jellyfin validation is
-complete. Plex account authorization and cleanup were exercised, but the test account returned no
-eligible Plex servers, so server/library discovery and sync-preference persistence remain outstanding.
-Do not mark #333 done until those remaining Plex steps are exercised against an account with a server.
+Results from the homelab runs are recorded under each flow. **Both flows are now complete.** Jellyfin
+validation finished on 2026-07-13. The Plex flow finished on 2026-07-16 against a disposable test Plex
+Media Server: authorization, server/library discovery, sync-preference persistence, and sign-out
+cleanup all passed. #333 is satisfied.
 
 ## 1. Jellyfin/Emby real-server connect
 
@@ -88,6 +88,41 @@ but no sign-out action. Cleanup therefore required the API. The exact request/st
 root-cause analysis are captured in
 [#345](https://gitea.tblindustries.be/timothy/ersatztv/issues/345).
 
+### Result — 2026-07-16: completed against a live Plex server
+
+The Plex-server prerequisite from the 2026-07-13 run was resolved: a disposable test Plex Media
+Server (`plex` container in the `media-servers` stack, reachable from ErsatzTV at `http://plex:32400`
+and on the LAN at `http://192.168.1.99:32400`, claimed to the account and seeded with a **Movies**
+library) was stood up specifically for this validation (#333 comment). Run against `ersatztv-test`
+(`:latest`, host port 8410); API state verified out-of-band with the machine key against the
+in-container port 8409.
+
+- [x] Real plex.tv pin flow completed. Server log recorded `Successfully authenticated with plex`
+  (21:33:27) with no discovery exception, and the SPA transitioned to the signed-in state without a
+  manual refresh.
+- [x] **Server discovery succeeded** (the 2026-07-13 gap): `GET /api/v1/media-sources/plex` reported
+  `isAuthorized: true`, `isLocked: false`, and `servers: [{ id: 3, name: "8d720a58d5d6",
+  address: "http://192.168.1.99:32400" }]`.
+- [x] Libraries populated for the discovered server:
+  `GET /api/v1/media-sources/plex/3/libraries` returned the **Movies** library
+  (`id: 16`, `mediaKind: Movies`, initial `shouldSyncItems: false`).
+- [x] Sync-preference persistence: toggled **Sync** on for Movies and saved in the SPA; the API then
+  reported `shouldSyncItems: true`, and the value survived a full SPA reload.
+- [x] Sign-out cleanup: signed out from the SPA (the **Sign out** affordance was present in the
+  with-server state, unlike the zero-server case in #345). The API returned to `isAuthorized: false`,
+  `isLocked: false`, `servers: []`; `GET /api/v1/media-sources/plex/3/libraries` then returned **404**
+  (no stale server/library data); the SPA showed **Not signed in** with no stale rows.
+
+No unexpected page errors. This completes the outstanding Plex steps and the #202 real-server
+integration validation. Note: #345 (authorized/zero-server SPA state) was not re-exercised here — this
+run always had a discovered server — so that specific edge case remains as filed.
+
+**Test-environment note:** the `ersatztv-test` local-admin credential (set by an earlier session and
+unrecorded) was reset to `admin` / the homelab default for this run by clearing the three
+`auth.local_admin.*` / `auth.security_stamp` `ConfigElement` rows and re-running first-run setup. The
+disposable `plex` container should be removed from the `media-servers` stack now that this flow is
+validated (server-management-owned compose change).
+
 ## Notes for whoever runs this
 
 - Use a throwaway/test Jellyfin or Emby API key if possible — the SPA's `hasApiKey` contract means the