docs: document plex as external systemd service on valhalla

CLAUDE.md

@@ -103,6 +103,21 @@ ssh ginnoir@valhalla "docker compose -f /config/portainer/compose/14/stacks/ownc
 - The `(internal_only)` snippet 403s any client outside `192.168.1.0/24`. `import internal_only` is how admin UIs (sonarr, qbittorrent, ...) stay LAN-only while public sites omit it.
 - Upstreams use container name + container-internal port (e.g. `qbittorrent:3232`), not host-published ports.
 
+## External services (not in compose)
+
+These run on valhalla but are managed outside of Portainer/Docker.
+
+### Plex Media Server
+
+- **Install:** deb package (`plexmediaserver`), managed by systemd. Not containerised.
+- **Version:** 1.43.2 (Watchtower doesn't touch it — update via `apt upgrade plexmediaserver` or the Plex UI).
+- **Service:** `systemctl {start,stop,restart,status} plexmediaserver`
+- **Binary:** `/usr/lib/plexmediaserver/`
+- **App data / metadata / DB:** `/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/`
+- **Media libraries:** `/storage1/Media/{Movies,TV,Anime}` — same ZFS pool bind-mounted into the *arr containers.
+- **Tautulli** (`tautulli` container in the media stack) reads PMS logs from `/storage1/Media` and connects to Plex over the LAN. It is **not** behind Authentik — Plex login is its own auth.
+- **Caddy:** Plex is not reverse-proxied through Caddy (Plex handles its own relay/direct connections). No `plex.ginnoir.com` block exists.
+
 ## Known quirks / gotchas
 
 - Portainer stack #6 `valhalla-lab` is **registration-only** (visibility in the Portainer UI). It