chore(localdev): optional read-only Plex media CIFS mount for dev

Lets the dev container play the physical media file locally (this box isn't the
Plex host). Host/share/credentials come from .env (gitignored) — no site-specific
values in the tracked compose. Mounts //${PLEX_SMB_HOST}/${PLEX_SMB_SHARE} at
/plex-media read-only in api + worker; harmless when the vars are unset. Prod (LXC
on the Plex host) uses a plain host bind-mount instead.

docker-compose.localdev.yml

@@ -58,6 +58,8 @@ services:
       # Downloaded media lives on the host so you can inspect the generated Plex tree.
       # Gitignored. The worker writes here; the API reads it to serve local downloads.
       - ./downloads:/downloads
+      # Plex media, read-only (see the plex_media volume note below). Maps to plex_path_map.
+      - plex_media:/plex-media:ro
     restart: unless-stopped
 
   # Dedicated download worker: same image, runs the yt-dlp job loop instead of the API.
@@ -87,6 +89,7 @@ services:
       - apparmor:unconfined
     volumes:
       - ./downloads:/downloads
+      - plex_media:/plex-media:ro
     restart: unless-stopped
 
   # PO-token provider: mints YouTube Proof-of-Origin tokens on demand so the worker bypasses
@@ -101,3 +104,16 @@ services:
 
 volumes:
   pgdata:
+  # OPTIONAL (Plex integration dev testing): the Plex media, mounted READ-ONLY from the SMB share
+  # so the container can play the physical file locally (this dev box isn't the Plex host). Uses a
+  # dedicated read-only samba user via PLEX_SMB_USER/PLEX_SMB_PASS in .env. Only referenced when the
+  # Plex module is enabled; harmless otherwise (Docker mounts it lazily on first container use). On
+  # prod (LXC on the Plex host) this is a plain host bind-mount instead — no SMB.
+  plex_media:
+    driver: local
+    driver_opts:
+      type: cifs
+      # Host/share + credentials come from .env (gitignored) so no site-specific values live in
+      # the tracked compose: PLEX_SMB_HOST, PLEX_SMB_SHARE, PLEX_SMB_USER, PLEX_SMB_PASS.
+      device: "//${PLEX_SMB_HOST:-localhost}/${PLEX_SMB_SHARE:-data}"
+      o: "username=${PLEX_SMB_USER:-},password=${PLEX_SMB_PASS:-},ro,vers=3.0,uid=1000,gid=1000,file_mode=0444,dir_mode=0555"