Migrate Plex to the cluster and validate QuickSync

Part of #241 (phase 3). **Blocked by #242**: QuickSync needs the mini
PC's integrated GPU, which the TrueNAS Atom C3338 does not have. Also
depends on storage classes (#245) and the GPU-affinity label from #243.

## Summary

Run Plex as a GPU-node-affinity singleton on the cluster and prove
QuickSync hardware transcoding works.

## Scope

- Deploy Plex (HelmRelease/manifests via Flux) as a singleton pinned to
node 1 via the GPU-affinity label.
- Install the **Intel device plugin**; rely on the Talos **i915
extension** for the iGP.
- Storage: **iSCSI** for the Plex config (SQLite), **NFS** for media.
- Validate hardware transcode: `vainfo` inside the pod lists the iGP,
and a **forced transcode** uses QuickSync (not CPU).
- Add a PDB (`maxUnavailable: 1` style) so drains/upgrades don't wedge
the singleton.

## Acceptance criteria

- [ ] Plex scheduled on the GPU node, config on iSCSI, media on NFS
- [ ] Intel device plugin present; iGP exposed to the pod
- [ ] `vainfo` shows the device; forced transcode confirmed on QuickSync
- [ ] Singleton PDB in place
- [ ] New files carry SPDX headers; pre-commit passes

Observability (Plex logs/usage) is tracked separately in #153 — don't
duplicate here.