fix(maintainerr): correct data volume path and enable TLS bypass for Plex

- Mount /config/maintainerr to /opt/data (actual DB location, not /opt/maintainerr/data)
- Add NODE_TLS_REJECT_UNAUTHORIZED=0 so Node.js accepts Plex's self-signed cert
- Mark TB-007/008/009/012/013/016 tasks as done/dropped in improvement plan

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plans/homelab-improvements/tasks/TB-016-document-plex.md

@@ -1,7 +1,7 @@
 # TB-016 — Document Plex
 
-**Status:** not started  
-**Your call:** _(unset — talk first)_
+**Status:** done  
+**Your call:** Do it
 
 ---
 
@@ -32,9 +32,9 @@
 
 | | |
 |---|---|
-| **Decision** | |
-| **Notes** | |
-| **Date** | |
+| **Decision** | Done — documented in CLAUDE.md under "External services" |
+| **Notes** | deb package, systemd, /var/lib/plexmediaserver data, /storage1/Media libraries, no Caddy proxy |
+| **Date** | 2026-06-15 |
 
 ---